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Countering  violent  extremism  (CVE)  programs  are  moving  into  the  realm  of 
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but  also  communicate  when  an  individual  remains  a  threat?  An  understanding  of  the  laws 
that  facilitate  or  restrict  disclosure  of  confidential  health  info,  combined  with  a  structure 
to  oversee  the  process,  is  critical.  Research  for  this  thesis  has  focused  on  federal  and 
Maryland  state  laws  pertaining  to  medical  record  confidentiality  and  the  duty  to  warn. 
This  legal  analysis  has  detennined  that  exceptions  exist  within  medical  confidentiality 
laws,  enabling  mental  health  practitioners  to  disclose  when  a  threat  exists,  and  that 
Maryland’s  duty-to-warn  laws  mandate  that  mental  health  practitioners  have  a  duty  to 
protect  third  parties  from  the  actions  of  patients.  Due  to  the  varied  disciplines  involved  in 
CVE,  collaborative  group  models  are  suggested  to  structure  the  process. 
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EXECUTIVE  SUMMARY 


As  the  threats  of  homegrown  violent  extremists  have  increasingly  become  a 
reality,  the  federal  government  has  created  a  countering  violent  extremism  (CVE) 
program  to  fill  the  pre-criminal  space.  Elements  of  the  CVE  program  are  designed  to  add 
the  missing  preventative  pieces  to  traditional  methods.  The  four  main  parts  of  the  U.S. 
CVE  design  are  community  engagement,  education  on  radicalization,  counter  narratives, 
and  intervention  programs  designed  to  deter  or  re-direct  individuals  from  a  path  to 
radicalization.  These  parts  are  the  same  basic  components  of  the  most  successful 
precursor  models,  namely  gang  diversion1  and  substance  abuse  diversion  programs.2 

Law  enforcement  (LE)  plays  an  integral  role  in  CVE,  but  the  effort  also  relies 
heavily  on  other  participants  and  stakeholders.  Mental  health  practitioners  must  play  a 
critical  role  in  both  the  intervention  and  education  segments  of  CVE  by  providing 
essential  services,  detecting  those  at  risk,  and  educating  others  on  the  radicalization 
process.  While  LE  and  mental  health  practitioners  represent  two  professions  dedicated  to 
helping  others,  a  mutual  understanding  or  cooperation  has  historically  been  lacking.3  This 
conflict  of  perceived  interests  and  obligations  has  slowed  meaningful  collaboration  in  the 
CVE  intervention  realm. 

How  can  mental  health  providers  treat  or  divert  individuals  from  the  path  to 
radicalization  but  still  share  risk  assessments  and  intelligence  with  LE  when  patients  pose 
a  threat  to  others?  CVE  programs  involved  in  intervention  and  diversion  need  a 
mechanism  or  policy  in  place  that  facilitates  the  notification  of  LE  authorities  when  a 


1  James  C.  Howell,  “Gang  Prevention:  An  Overview  of  Research  and  Programs,  Juvenile  Justice 
Bulletin,”  Office  of  Juvenile  Justice  and  Delinquency  Prevention,  2010,  12,  http://eric.ed.gov/7kHED 
518416. 

2  Jason  Payne,  Max  Kwiatkowski,  and  Joy  Wundersitz,  Police  Drug  Diversion:  A  Study  of  Criminal 
Offending  Outcomes,  Research  and  Public  Policy  Series,  no.  97  (Canberra:  Australian  Institute  of 
Criminology,  2008),  xi. 

3  James  R.  Corbin,  “Confidentiality  &  the  Duty  to  Warn:  Ethical  and  Legal  Implications  for  the 
Therapeutic  Relationship,”  The  New  Social  Worker,  April  23,  2014,  1,  http://www.socialworker.com/ 
api/content/f6758ddl-7700-3ccb-95ab-96de65ea6fcd/. 
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diversion  practitioner  suspects  that  the  client  is  not  responding  to  diversion  efforts  or  a 
determination  is  made  that  the  individual  presents  a  risk  to  others. 

The  beginning  steps  involve  an  understanding  of  the  legal  environment  that 
applies  to  the  effort.  Mental  health  practitioners  are  bound  by  federal  and  state  laws  that 
may  restrict  or  facilitate  the  disclosure  of  privileged  personal  health  information  (PHI). 

A.  MEDICAL  RECORD  CONFIDENTIALITY 

In  reference  to  medical  confidentiality  laws,  it  is  imperative  that  practitioners 
understand  the  existence  of  both  the  federal  Health  Insurance  Portability  and 
Accountability  Act  (HIPAA)  law  and  specific  state  laws.  In  relation  to  HIPAA, 
stakeholders  must  understand  that  the  HIPPA  Privacy  Rule  only  identifies  two  mandatory 
disclosures  of  PHI,  to  the  patient,  and  to  Department  of  Health  and  Human  Services 
(DHHS)  for  auditing  purposes.  The  remaining  exceptions  provide  permissible  conditions 
for  mental  health  practitioners  to  share  information.  In  terms  of  CVE,  the  two  applicable 
exceptions  to  confidentiality  when  a  mental  health  practitioner  may  disclose  information 
are  located  in  paragraphs  (j)  and  (k)  of  the  HIPAA  Privacy  Rule.4  Paragraph  (J)  allows  a 
medical  provider  (mental  health  professional)  to  disclose  PHI  when  it  is  “necessary  to 
prevent  or  lessen  a  serious  and  imminent  threat  to  the  health  and  safety  of  a  person  or  the 
public.”5  Paragraph  (K)  presents  a  broader  exception  to  the  federal  law  in  that  it  allows 
for  the  disclosure  of  PHI  to  protect  national  security.  The  paragraph  allows  for  the 
disclosure  to  “authorized  federal  officials”  for  the  purpose  of  conducting  “lawful 
intelligence,  counter-intelligence,  and  other  national  security  activities.”6  It  is  important 
to  note  that  these  exceptions  to  federal  law  are  pennissive  and  do  not  require  the 
disclosure  of  PHI.  It  is  clear,  however,  that  mental  health  practitioners  involved  in 
intervention  may,  under  federal  law,  disclose  otherwise  protected  information  if  their 
client  poses  a  threat  of  violence. 


4  U.S.  Government,  45  CFR  Part  164  Subpart  E — Privacy  of  Individually  Identifiable  Health 
Information  (Washington,  DC:  Government  Printing  Office,  n.d.),  764-765,  accessed  August  6,  2016, 
https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-voll/pdf/CFR-2007-title45-voll-partl64-subpartE.pdf. 

5  Ibid.,  764. 

6  Ibid.,  765. 
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Like  the  Privacy  Rule,  Maryland  state  laws  on  medical  record  confidentiality  are 
pennissive  in  nature.  Maryland  law  is  broader  than  the  federal  law  in  regards  with  whom 
PHI  may  be  shared.  Maryland  law  allows  for  the  disclosure  of  PHI  to  any  government 
agency  conducting  authorized  actions  (as  described  by  law).  Practitioners  will  be 
challenged  when  blending  state  and  federal  law.  Maryland  law  also  allows  for  the  release 
of  information  for  an  investigative  process.  The  law  does  stipulate  that  the  receiving 
agency  must  have  written  policies  in  place  to  protect  the  infonnation.  Many  law 
enforcement  (LE)  agencies  do  not  have  written  procedures  for  the  protection  and  safe 
storing  of  PHI.  As  a  result,  LE  agencies  involved  in  CVE  actions  must  create  these  types 
of  policies. 

Practitioners  in  Maryland  must  also  understand  that  they  must  disclose,  or  not 
disclose,  PHI  in  compliance  with  the  law  to  be  immune  from  civil  action. 

CVE  programs  may  also  use  consent  to  share  information.  Consent  is  the  easiest 
and  cleanest  practice  that  may  address  the  issue  of  communication  among  stakeholders. 
The  process  must  include  a  written  waiver  completed  by  the  client.  The  waiver  must 
include  the  length  of  the  consent  and  under  what  circumstances  it  may  be  revoked.  Under 
Maryland  law,  the  consent  process  is  described  under  §4-303. 7 

B.  DUTY  TO  WARN  AND  PROTECT 

As  with  medical  confidentiality  laws,  training  on  duty  to  warn  and  protect  laws 
will  be  critical  for  practitioners  involved  in  CVE  intervention  and  diversion.  Mental 
health  professionals  working  with  CVE  programs  should  already  be  well  versed  on  the 
ethical  and  legal  conditions  imposed  upon  their  work.  The  practitioners  may  not, 
however,  have  experience  working  with  other  professionals  from  other  disciplines.  They 
also  may  not  be  well  versed  on  the  exceptions  to  confidentiality  in  relation  to  the  threat 
presented  by  radicalized  persons. 


7  State  of  Maryland,  22.  Medical  Records  Act— Duty  to  Hold  Confidential  and  Duty  to  Disclose  a 
Medical  Record,  Health-General  Article  §  §  4-301-4-309,  8-601  (Baltimore,  MD:  Maryland  Department 
of  Mental  Health  and  Hygiene,  n.d.),  accessed  September  12,  2016,  http://dhmh.maryland.gov/psych/pdfs/ 
Medicalreports.pdf. 
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The  terms  “duty  to  warn”  and  “duty  to  protect”  were  born  of  a  series  of  incidents, 
and  subsequent  legal  maneuvers,  in  California  in  the  late- 1960s  and  mid-1970s.  The 
events  of  concern  were  litigated  in  the  California  case  of  Tarasoff  v.  Regents  of 
University  of  California.8 

As  duty  to  warn  and  duty  to  protect  laws  reside  at  the  state  level,  practitioners 
must  be  aware  of  the  laws  of  the  state  where  they  are  practicing.  Additionally,  many  laws 
are  written  in  a  broad  manner  that  does  not  clearly  articulate  what  is  forbidden,  mandated, 
or  allowed.  Many  of  these  laws,  such  as  Maryland’s,  allow  for  discretion.  Mental  health 
practitioners  must  have  access  to  legal  experts  to  assist  in  deciphering  and  applying  the 
law,  which  is  especially  important  when  situations  are  frequently  not  the  same. 

Maryland  is  a  mandatory  duty-to-protect  state.  The  affirmative  nature  of  the  duty 
may  differ  from  other  states  in  that  it  provides  for  options  for  which  a  therapist  may  act 
and  does  not  specifically  dictate  which  option  the  therapist  must  choose.  The  statute  is 
located  in  Maryland’s  Courts  and  Judicial  Proceedings  Section  §5-609. 9  Section  (b) 
outlines  the  mandated  duty  to  protect  as  occurrences  when  a  mental  health  care  provider 
is  aware  that  a  patient  is  capable  of  violent  behavior  against  a  known  victim  or  group  of 
victims.  The  statue  provides  immunity  from  legal  or  disciplinary  action  if  the  provider  for 
discharge  of  the  duty  to  warn  or  protect.  Section  (b)  also  describes  the  manner  in  which  a 
provider  may  come  to  know  of  the  threat  posed  by  a  patient  as  the  patient’s  spoken  word, 
writing,  or  conduct.10 

Section  (c)  (2)  provides  the  options  for  the  discharge  of  the  duty  that  a  provider 
may  take.  The  statue  allows  for  discretion  on  the  part  of  the  provider  to  either  seek  a 
commitment  for  the  patient,  construct  a  treatment  plan  to  address  the  potential  violence, 
inform  a  LE  agency  of  the  danger  posed  by  the  patient,  or  warn  the  intended  victim(s).  If 


8  “Tarasoff  v.  Regents  of  University  of  California — 17  Cal. 3d  425 — Thu,  07/01/1976|California 
Supreme  Court  Resources,”  accessed  August  28,  2016,  http://scocal.stanford.edu/opinion/tarasoff-v- 
regents-university-california-30278. 

9  “Courts  and  Judicial  Proceedings,  Section  5-609,”  accessed  September  10,  2016,  http://mgaleg. 
maryland.gov/webmga/frmStatutesText.aspx?article=gcj&section=5-609&ext=html&session=2015RS& 
tab=subject5. 

10  Ibid. 


the  provider  decides  to  provide  a  warning  to  LE  or  the  intended  victim(s),  the  stature 
delineates  that  the  warning  must  include  the  nature  of  the  threat,  the  identity  of  the 
patient,  and  the  identity  of  the  intended  victim(s).  As  a  result,  Maryland’s  law  is  both  a 
duty  to  warn  and  a  duty  to  protect  statute.  The  law  is  mandatory  in  requiring  the  therapist 
to  take  action  to  protect,  but  allows  discretion  in  how  the  provider  discharges  the  duty. 
The  law  also  states  that  the  actions  taken  by  the  provider  must  be  both  reasonable  and 
timely.11 

Mental  health  practitioners  working  with  CVE  programs  within  the  state  of 
Maryland  are  thus  bound  by  state  law  to  protect  third  parties  from  the  actions  of  their 
clients.  The  law  does,  however,  provide  a  certain  amount  of  discretion  in  how  the 
practitioner  addresses  the  threat.  Since  CVE  programs  are  collaborative  efforts,  mental 
health  practitioners  may  rely  on  advice  and  input  from  other  disciplines. 

C.  CVE  STRUCTURE  MODELS 

The  Building  Resistance  against  Violent  Extremism  (BRAVE)  model  of  CVE  is 
currently  operating  in  Montgomery  County,  Maryland,  and  is  expected  to  expand  to  other 
jurisdictions.12 

According  to  its  strategic  plan,  the  BRAVE  model  in  Montgomery  County 
describes  itself  as  a  “collective  impact  initiative”  (CII).13  “Collective  Impact  is  a 
framework  to  tackle  deeply  entrenched  and  complex  social  problems.  It  is  an  innovative 
and  structured  approach  to  making  collaboration  work  across  government,  business, 
philanthropy,  non-profit  organizations  and  citizens  to  achieve  significant  and  lasting 
social  change.”14  The  idea  of  a  CII  was  first  written  about  in  the  Stanford  Social 
Innovation  Review  in  201 1.  According  to  the  article,  five  key  elements  are  needed  for  a 

11  “Courts  and  Judicial  Proceedings,  Section  5-609.” 

12  World  Organization  for  Resource  Development  and  Education  (WORDE),  The  Building  Resilience 
against  Violent  Extremism  (BRAVE)  Model — A  Collective  Impact  Initiative  That  Increases  Public  Safety 
and  Social  Cohesion  (Montgomery  Village,  MD:  World  Organization  for  Resource  Development  and 
Education  (WORDE),  2016,  https://drive.google.eom/file/d/OB8ZeOqiUkpq2MUZheTd5eUNKRVk/ 
view?usp=sharing&usp=embed_facebook. 

13  Ibid.,  12. 

14  “The  Collective  Impact  Framework  |  Collaboration  for  Impact,”  accessed  October  16,  2016,  http:// 
www.collaborationforimpact.com/collective-impact/. 
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successful  program:  a  common  agenda,  shared  measurements  systems,  mutually 
reinforcing  activities,  continuous  communication,  and  a  backbone  support  organization. 


Common  Agenda 

•  Keeps  all  parties  moving  towards  the  same  goal 

Common  Progress  Measures 

•  Measures  that  gert  to  the  TRUE  outcome 

Mutually  Reinforcing  Activities 

•  Each  expertise  is  leveraged  as  part  of  the  overall 

Communications 

•  This  allows  a  culture  of  collaboration 

Backbone  Organization 

•  Takes  on  the  role  of  managing  collaboration 


Figure  1.  Collective  Impact  Initiative.15 


CIIs  are  models  that  may  be  applied  to  organizational  structures  to  ensure  that 
practitioners  are  working  together  to  achieve  a  common  goal.  The  BRAVE  model  is 
currently  the  only  true  community  led  CVE  initiative  in  existence. 

The  BRAVE  model  also  calls  for  the  creation  of  an  intervention  task  force  to 
oversee  intervention  efforts.  While  the  task  force  is  not  currently  being  used,  it  is 
envisioned  to  work  in  the  same  manner  as  a  multi-disciplinary  team  (MDT).16  The  MDT 
approach  identifies  practitioners  with  critical  responsibilities  to  an  issue,  and  brings  those 
practitioners  together  to  form  a  team.  The  practitioners  represent  agencies  that  have  a 
stake  in  the  solution  of  the  challenge.  The  practitioners  are  brought  together  as  subject 
matter  experts  on  their  aspect  or  interest  in  the  issue.  The  goal  is  to  form  a  team  of 
experts  where  each  expert  represents  a  different  discipline  for  the  purpose  of 

15  “The  Collective  Impact  Framework  |  Collaboration  for  Impact.” 

World  Organization  for  Resource  Development  and  Education  (WORDE),  The  Building  Resilience 
against  Violent  Extremism  (BRAVE)  Model — A  Collective  Impact  Initiative  That  Increases  Public  Safety 
and  Social  Cohesion,  16. 
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collaborating  on  complex  challenges.  One  of  the  assumptions  of  the  effort  is  that 
individual  practitioners  would  not  benefit  from  the  expertise  of  team  members  from 
different  disciplines  if  the  team  was  not  formed.  The  practitioners  represent  each  of  their 
disciplines  and  work  to  collaborate  the  efforts  of  their  organizations  with  the  partner 
agencies.  The  goal  is  to  create  a  common  plan  to  overcome  a  challenge  and  identify  the 
role  of  each  discipline.  MDTs  have  been  used  in  the  United  Stated  for  several  decades, 
with  a  high  level  of  success,  in  the  area  of  physical  and  sexual  child  abuse.  The  MDT 
approach  was  first  applied  to  child  sexual  abuse  in  the  1980s  by  the  National  Children’s 
Advocacy  Center  (NCAC)  in  Huntsville,  Alabama.17  MDTs  are  currently  used  in 
Montgomery  County  to  coordinate  child  abuse  investigations. 

CVE  programs  should  use  structural  models  similar  to  CIIs  and  MDTs  to 
facilitate  the  cooperation  of  stakeholders  from  different  disciplines.  A  structure  similar  to 
a  MDT  is  needed  to  manage  the  screening  and  service  plan  of  persons  receiving 
assistance  in  intervention  programs.  MDTs  should  be  led  by  mental  health  practitioners 
who  possess  the  training  and  experience  needed  to  access  and  manage  treatment  properly. 
The  teams  should  also  include  legal  professionals  and  LE  to  manage  the  balance  between 
successful  treatment  and  public  safety. 


17  “National  Children’s  Advocacy  Center  History,”  accessed  July  11,  2016,  http://www.nationalcac. 
org/table/about/history/. 


xix 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


xx 


ACKNOWLEDGMENTS 


This  paper  is  dedicated  to  all  the  men  and  women  who  have  devoted  their  lives  to 
helping  other  people.  These  noble  endeavors  are  frequently  undertaken  by  everyday 
heroes  who  are  quick  to  deflect  recognition.  My  classmates  are  perfect  examples.  I 
remain  proud  and  grateful  to  walk  among  them  and  call  them  friends. 

Without  the  support  of  my  organization,  I  would  not  have  been  able  to  apply,  let 
alone  complete,  the  Center  for  Homeland  Defense  and  Security  program.  I  extend  special 
recognition  to  the  following  Montgomery  County  Police  professionals: 

Chief  J.  Thomas  Manger 
Assistant  Chief  Darryl  McSwain 
Assistant  Chief  Luther  Reynolds 
Assistant  Chief  Betsy  Davis 
Assistant  Chief  Russel  Hamill 
Captain  Paul  Liquorie 
Captain  Nancy  Dennne  (ret.) 

Lieutenant  Phillip  Raum  (ret.) 

and 

Montgomery  County  Fire  and  Rescue  Service  Chief  Scott  Goldstein  (who  took 
the  time  to  call  me  while  I  was  driving  to  West  Virginia  the  night  before  my  first  day  of 
class). 


I  thank  my  advisors  for  their  expert  tutelage,  and  my  editor,  Nancy  Sharrock,  for 
her  excellent  service.  My  sincere  appreciation  is  also  extended  to  the  professors  and  staff 
of  the  Naval  Postgraduate  School.  I  remain  unclear  on  how  a  simple  cop  came  to  be 
educated  by  the  brightest  and  best,  but  I  will  apply  the  lessons  to  my  profession. 

My  parents,  Joseph  and  Ann  Marie  Ward,  instilled  within  me  the  importance  of 
pursuing  a  good  education  and  the  desire  to  choose  a  career  that  matters.  Without  their 
love  and  support,  I  would  not  be  where  I  am  today. 

Lastly,  I  thank  my  wife,  Alanna,  for  her  support  and  patience  over  the  last 
18  months  (actually,  for  the  last  23  years).  I  am  a  better  man  because  of  you,  Alanna. 


xxi 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


I.  INTRODUCTION 


In  Colorado,  a  seemingly  normal  and  bright  young  girl  was  raised  in  a  middle 
class  suburb  of  Denver.  The  daughter  of  a  Catholic  college  professor,  she  took  honors 
courses  at  the  local  high  school.  She  did  not  display  troubling  behavior,  and  enjoyed 
interacting  with  her  friends.  She  was  like  any  number  of  other  American  teenagers. 

In  her  junior  year,  the  girl — Shannon — began  wearing  traditional  Muslim 
clothing.  See  Figure  1.  On  her  Facebook  page,  she  changed  her  name  from  Shannon  to 
Halima  (Arabic  for  “gentle”).  She  began  frequenting  a  Christian  mega-church  while 
wearing  her  traditional  Muslim  clothing.1 


1  Jenny  Deam,  “Colorado  Woman’s  Quest  for  Jihad  Baffles  Neighbors,”  Latimes.com,  July  25,  2014, 
http://www.latimes.com/nation/la-na-high-school-jihadi-20140726-story.html. 

-  Source:  TheDenverChannel.com  Team,  “Shannon  Conley,  Arvada  Teen  Who  Tried  to  Join  ISIS  to 
Wage  Jihad,  Sentenced  to  4  Years  in  Prison,”  7NEWS,  January  24,  2015,  http://www.thedenverchannel. 
com/news/local-news/sentencing-for-shannon-conley-arvada-teen-who-tried-to-join-isis-to-wage-jihad. 
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Church  officials  approached  the  young  woman  and  inquired  if  she  had  questions 
or  was  interested  in  joining  the  church;  she  replied  that  she  was  Muslim  and  was  there  to 
conduct  research.  Shortly  thereafter,  the  Federal  Bureau  of  Investigation  (FBI)  was 
notified  and  conducted  their  first  interview  of  Shannon  Maureen  Conley.3 

Nothing  Conley  was  doing  was  illegal;  but  she  was  in  the  process  of  radicalizing 
to  Islamic  extremism.  She  had  been  watching  DVDs  of  Anwar  al-Awlaki  and  other 
jihadists.4  Conley  met  an  Islamic  State  (IS)  jihadist  on-line,  and  agreed  to  travel  to  the 
Middle  East  to  marry  him  and  join  him  in  waging  jihad.  She  was  also  apparently  pursuing 
military-style  tactical  training.  Her  parents,  aware  of  her  plans,  were  alanned. 

The  FBI  interviewed  Conley  eight  times  over  the  course  of  five  months.  Six  of  the 
interviews  were  conducted  with  her  parents  present.  Agents  pleaded  with  Conley  to 
abandon  her  radical  views  of  Islam.5  The  agents  also  beseeched  her  parents  to  dissuade 
her  from  committing  any  crimes  or  traveling  to  join  a  terror  group.  On  April  8,  2014, 
shortly  after  the  FBI’s  last  conversation  with  Conley,  she  was  arrested  at  Denver 
International  Airport,  en  route  to  Turkey  and  then  Syria.  Conley  was  charged  federally 
with  providing  material  support  to  a  terrorist  group. 

In  January  2015,  a  federal  judge  sentenced  Conley  to  four  years  in  prison  after  she 
admitted  to  trying  to  travel  to  Syria  to  join  the  IS.  The  judge  who  sentenced  her  stated 
that  he  believed  she  needed  psychiatric  care,  but  also  noted  that  she  had  remained  defiant 
and  possibly  dangerous.  “Added  the  judge,  She  has  no  history  in  the  criminal  justice 
system.  She  is  very  young... Teenagers  make  dumb  decisions  a  lot.”6  At  sentencing, 
Conley  claimed  that  she  had  been  wrong  and  now  understood  that  Islamic  State  of  Iraq 
and  Syria  (ISIS)  had  corrupted  Islam  and  the  Quran.  Prosecutors  argued  for  the  four-year 
sentence  to  dissuade  others  from  taking  a  similar  path. 

3  TheDenverChannel.com  Team,  “Shannon  Conley,  Arvada  Teen  Who  Tried  to  Join  ISIS  to  Wage 
Jihad,  Sentenced  to  4  Years  in  Prison.” 

4  Michael  Martinez,  Ana  Cabrera,  and  Sara  Weisfeldt,  “Colorado  Woman  Gets  4  Years  for  Wanting  to 
Join  ISIS,”  CNN,  January  24,  2015,  http://www.cnn.com/2015/01/23/us/colorado-woman-isis-sentencing/ 
index.html. 

5  Deam,  “Colorado  Woman’s  Quest  for  Jihad  Baffles  Neighbors.” 

6  Martinez,  Cabrera,  and  Weisfeldt,  “Colorado  Woman  Gets  4  Years  for  Wanting  to  Join  ISIS.” 
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The  greatest  irony  of  the  Shannon  Conley  case  is  that  both  her  family  and  the  FBI 
were  aware  of  her  activities  and  took  steps  to  try  and  convince  her  from  continuing  on  her 
path,  and  it  was  not  enough.  It  is  perfectly  legal  in  the  United  States  to  be  vulnerable  to 
radicalization  to  violent  extremism,  to  radicalize,  or  even  to  express  radical  beliefs.  For 
this  reason,  authorities  undertake  investigative  or  prosecutorial  activities  only  once  a 
crime  has  been  committed.  The  problem  is  not,  in  the  first  instance,  that  authorities  fail  to 
recognize  or  track  would-be  terrorists  and  their  plans.  Law  enforcement  (LE)  and 
intelligence  communities  around  the  world  are  aware  of  individuals  who  pose  a  possible 
danger  to  society  but  who  have  not  committed  a  crime,  or  at  least  a  crime  the  government 
wished  to  prosecute.  French  officials,  for  example,  were  aware  of  the  suspect  brothers 
who  committed  the  Charlie  Hebdo  attacks  and  murders  in  Paris  in  2015.  The  government 
conducted  surveillance,  but  the  brothers  were  not  observed  committing  any  crimes,  so  the 
authorities  turned  their  attention  to  other  potentially  violent  suspects.  It  turned  out  that  the 
brothers  were  planning  mass  murder,  but  they  had  not  revealed  any  suspicious  signs 
during  the  course  of  the  government’s  investigation.7  Similarly,  the  homegrown  violent 
extremist  (HVE)  who  committed  murder  at  an  Orlando  nightclub  had  twice  previously 
been  investigated  by  the  FBI.8  When  the  FBI  exhausted  all  plausible  investigative  efforts, 
agents  had  no  choice  but  to  let  this  future  killer  go.  The  FBI  and  other  federal  LE 
agencies  are  restricted  in  their  options  in  advance  of  a  criminal  act  by  a  process  that 
regulates  their  ability  to  open  fonnal  investigations,  and  limits  the  length  of  the 
investigation. 

As  the  threats  of  HVE  have  increasingly  become  a  reality,  the  federal  government 
has  created  a  countering  violent  extremism  (CVE)  program  to  fill  the  pre-criminal  space. 
Elements  of  the  CVE  program  are  designed  to  add  the  missing  preventative  pieces  to 
traditional  methods.  The  four  main  parts  of  the  U.S.  CVE  design  are  community 
engagement,  education  on  radicalization,  counter  narratives,  and  intervention  programs 


7  Scott  Bronstein,  “Cherif  and  Said  Kouachi:  Their  Path  to  Terror,”  CNN,  January  14,  2015,  http:// 
www.  cnn.  com/20 15/0 1/1 3/world/kouachi-brothers-radicalization/index.html. 

8  Del  Quentin  Wilber,  “The  FBI  Investigated  the  Orlando  Mass  Shooter  for  10  Months — and  Found 
Nothing.  Flere’s  Why,”  Latimes.com,  July  14,  2016,  http://www.latimes.com/nation/la-na-fbi-investigation- 
mateen-20160712-snap-story.html. 
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designed  to  deter  or  re-direct  individuals  from  a  path  to  radicalization.  These  parts  are  the 
same  basic  components  of  the  most  successful  precursor  models,  namely  gang  diversion9 
and  substance  abuse  diversion  programs.10 

LE  plays  an  integral  role  in  CVE,  but  the  effort  also  relies  heavily  on  other 
participants  and  stakeholders.  Mental  health  practitioners  must  play  a  critical  role  in  both 
the  intervention  and  education  segments  of  CVE  by  providing  essential  services, 
detecting  those  at  risk,  and  educating  others  on  the  radicalization  process.  While  LE  and 
mental  health  practitioners  represent  two  professions  dedicated  to  helping  others,  a 
mutual  understanding  or  cooperation  has  historically  been  lacking.11  LE  is  frequently  a 
profession  charged  with  gathering  information,  and  the  field  of  mental  health  is  generally 
a  profession  ethically  and  legally  bound  to  protect  the  confidentiality  of  its  patients.  This 
conflict  of  perceived  interests  and  obligations  has  slowed  meaningful  collaboration  in  the 
CVE  intervention  realm. 

A.  RESEARCH  QUESTION 

How  can  mental  health  providers  treat  or  divert  individuals  from  the  path  to 
radicalization  but  still  share  risk  assessments  and  intelligence  with  LE  when  patients  pose 
a  threat  to  others?  CVE  programs  involved  in  intervention  and  diversion  need  a 
mechanism  or  policy  in  place  that  facilitates  the  notification  of  LE  authorities  when  a 
diversion  practitioner  suspects  that  the  client  is  not  responding  to  diversion  efforts  or  a 
determination  is  made  that  the  individual  presents  a  risk  to  others.  What  should  such  a 
policy  comprise? 


9  James  C.  Howell,  “Gang  Prevention:  An  Overview  of  Research  and  Programs.  Juvenile  Justice 
Bulletin,”  Office  of  Juvenile  Justice  and  Delinquency  Prevention,  2010,  12,  http://eric.ed.gov/7idMiD518 
416. 

10  Jason  Payne,  Max  Kwiatkowski,  and  Joy  Wundersitz,  Police  Drug  Diversion:  A  Study  of  Criminal 
Offending  Outcomes,  Research  and  Public  Policy  Series,  no.  97  (Canberra:  Australian  Institute  of 
Criminology,  2008),  xi. 

11  James  R.  Corbin,  “Confidentiality  &  the  Duty  to  Warn:  Ethical  and  Legal  Implications  for  the 
Therapeutic  Relationship,”  The  New  Social  Worker,  1,  April  23,  2014,  http://www.socialworker.com/api/ 
content/f6758ddl-7700-3ccb-95ab-96de65ea6fcd/ 
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B.  PROBLEM  STATEMENT 

The  United  States  has  adopted  CVE  as  a  preventative  aspect  of  its 
counterterrorism  strategy.  In  2011,  the  U.S.  government  issued  a  report  titled. 
Empowering  Local  Partners  to  Prevent  Violent  Extremism  in  the  United  States}2  The 
report  documents  the  government’s  position  that  traditional  efforts,  including  diplomatic 
relations,  military  action,  intelligence  gathering  and  analysis,  and  investigative  and 
prosecutorial  processes,  were  deemed  insufficient  in  preventing  and  deterring  HVEs  in 
the  homeland.13  CVE  programs  are  focused  on  building  trusting  relationships  between 
the  govermnent  and  the  communities  they  serve,  training  practitioners  and  community 
members  on  radicalization  and  terrorism,  countering  the  narratives  of  violent  jihad, 
providing  an  deflection  or  diversion  application  to  redirect  individuals  at-risk  or  engaged 
in  the  radicalization  process,  and  providing  an  intervention  element  to  assist  individuals 
who  may  be  at  risk  for  radicalization.14 

1.  Intervention,  Deflection,  and  Diversion 

George  Washington  University  Professor  Dr.  Lorenzo  Vidino  divides  the 
categories  of  radicalization  into  two  parts.  According  to  Vidino: 

Cognitive  radicalization  is  the  process  through  which  an  individual  adopts 
ideas  that  are  severely  at  odds  with  those  of  the  mainstream,  refutes  the 
legitimacy  of  the  existing  social  order,  and  seeks  to  replace  it  with  a  new 
structure  based  on  a  completely  different  belief  system.  Violent 
radicalization  occurs  when  an  individual  takes  the  additional  step  of  using 
violence  to  further  the  views  derived  from  cognitive  radicalization.15 


13  Executive  Office  of  the  President  of  the  United  States,  Empowering  Local  Partners  to  Prevent 
Violent  Extremism  in  the  United  States  (Washington,  DC:  Executive  Office  of  the  President  of  the  United 
States,  2011),  https://www.whitehouse.gov/sites/default/files/empowering_local_partners.pdf. 

13  Ibid.,  2. 

14  Executive  Office  of  the  President  of  the  United  States,  Strategic  Implementation  Plan  for 
Empowering  Local  Partners  to  Prevent  Violent  Extremism  in  the  United  States  (Washington,  DC: 
Executive  Office  of  the  President  of  the  United  States,  2011),  https://www.whitehouse.gov/sites/ 
default/files/sip-final.pdf. 

15  Lorenzo  Vidino  and  James  Brandon,  Countering  Radicalization  in  Europe  (London:  International 
Centre  for  the  Study  of  Radicalization  and  Political  Violence,  2012),  9-10. 


5 


Vidino’s  assertion  describes  the  difference  between  an  individual  who  is  radicalized  and 
an  individual  who  is  radicalized  and  involved  in  illegal  or  violent  activities. 

Intervention  programs  are  designed  to  provide  services  for  individuals  who  are 
vulnerable  to  radicalization;  these  people  might  be  immigrants  who  are  having  a  hard 
time  adjusting  to  a  new  culture,  or  teenagers  experiencing  social  difficulties.  Deflection 
and  diversion  programs  are  designed  for  individuals  involved  in  the  radicalization 
process.  Diversion  programs  are  designed  to  be  in  lieu  of  incarceration  after  or  during  a 
prosecution.  Deflection  programs  are  used  “when  a  law  enforcement  agency  is  aware  of 
the  subject  but  instead  of  prosecution  or  before  a  crime  is  committed,  the  individual  is 
referred  to  an  intervention  program.”16 

According  to  the  strategic  plan  issued  by  the  World  Organization  for  Resource 
Development  and  Education  (WORDE)  for  the  Building  Resilience  Against  Violent 
Extremism  model  of  CVE: 

Both  diversion  and  deflection  programs  attempt  to  divert  or  channel 
offenders  away  from  the  justice  system  by  providing  intense  wrap-around 
services,  including  counseling,  mentoring,  case  management,  and 
community  service  opportunities.  Such  programs  are  often  conducted  in 
partnership  with  police  departments,  courts,  district  attorneys,  or  non¬ 
governmental  agencies  in  lieu  of  incarceration  or  prosecution  and  often 
require  reporting  compliance  to  the  referring  agency.17 

For  the  purpose  of  this  thesis,  collectively,  all  three  are  referred  to  as 
“intervention.”  “Intervention  efforts  are  typically  provided  by  trained,  experienced,  and 
licensed  mental  health  practitioners.  These  experts  include  social  workers,  clinicians, 


16  World  Organization  for  Resource  Development  and  Education  (WORDE),  The  Building  Resilience 
against  Violent  Extremism  (BRAVE)  Model — A  Collective  Impact  Initiative  That  Increases  Public  Safety 
and  Social  Cohesion  (Montgomery  Village,  MD:  World  Organization  for  Resource  Development  and 
Education  (WORDE),  2016,  19,  https://drive.google.eom/file/d/OB8ZeOqiUkpq2MUZheTd5eUNKRVk/ 
view?usp=sharing&usp=embed_facebook. 

17  Ibid. 
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therapists,  psychiatrists,  and  psychologists.  (Referrals  for  intervention  also  come  from  the 
community  and  government.)”18 

Clinicians  and  therapists  involved  in  intervention  efforts  are  bound  by  ethical  and 
legal  obligations  to  maintain  the  confidentiality  of  the  persons  they  are  treating.19  As  a 
result,  legal  restrictions  may  be  in  place  prohibiting  or  mandating  the  notification  of  LE. 
On  the  other  hand,  a  situation  may  emerge  in  which  the  therapists  may  be  assessing  a 
client  who  has  been  referred  for  intervention  without  recognizing  clues  that  may  indicate 
that  the  client  poses  a  risk  to  the  rest  of  society.  In  such  a  scenario,  communication 
between  diversion  and  intervention  practitioners  and  LE  sources  may  be  crucial. 

2.  Medical  Record  Confidentiality 

Practitioners  may  be  affected  and  limited  in  their  ability  to  disclose  client  or 
patient  information  by  federal  HIPAA  laws  and  state  statutes  directed  towards  medical 
record  confidentiality.20  HIPAA  and  state  laws  were  created  to  protect  patients’  privacy 
rights,  but  they  also  provide  for  exceptions  to  fulfill  crucial  LE  and  public  health 
functions.  Some  of  the  exceptions  to  confidentiality  and  privacy  laws  include  responses 


18  The  community  referrals  may  come  from  “bystanders,”  defined  as  individuals  who  are  close,  or  in 
contact  with,  an  individual  who  is  at  risk  or  engaged  in  a  radicalization  process.  See  Thomas  Schillinger, 
“Bystander  Effect  and  Religious  Group  Affiliation:  Terrorism  and  the  Diffusion  of  Responsibility”  (PhD 
diss.,  Walden  University,  2014),  http://scholarworks.waldenu.edU/dissertations/126/.Bystanders  may  be 
family  members,  friends,  co-workers,  religious  associates,  or  neighbors.  When  bystanders  make  a  referral 
to  a  CVE  for  diversion,  the  presence  and  identity  of  the  individual  referred  may,  or  may  not,  be  known  to 
government  authorities.  Mechanisms  and  processes  may  not  be  in  place  to  facilitate  notification  of  LE 
when  the  referred  individual  presents  a  threat.  Examples  of  intervention  referrals  originating  from 
government  sources  are  court  referrals,  juvenile  justice  systems  referrals,  referrals  from  LE  (i.e.,  a  referral 
from  a  school  resource  officer),  referrals  from  Health  and  Human  Services  agencies,  referrals  from  schools, 
and  referrals  directly  from  terrorism  investigative  agencies,  such  as  the  FBI  and  the  FBI’s  Joint  Terrorism 
Task  Forces  (JTTF). Typically,  in  cases  where  the  referral  originates  from  an  investigative  agency,  an 
investigation  has  been  conducted  and  a  determination  has  been  made  that  no  charges  or  prosecution  will 
take  place  at  the  time  of  the  referral.  This  finding  does  not  ensure  that  the  target  of  the  investigation  does 
not  pose  a  risk,  that  the  investigation  will  not  continue,  or  that  charges  will  not  be  placed  in  the  future. 

19  Corbin,  “Confidentiality  &  the  Duty  to  Warn:  Ethical  and  Legal  Implications  for  the  Therapeutic 
Relationship.” 

20  “When  Does  the  Privacy  Rule  Allow  Covered  Entities  to  Disclose  Protected  Health  Information  to 
Law  Enforcement  Officials?,”  accessed  September  19,  2015,  http://www.hhs.gov/ocr/privacy/hipaa/faq/ 
disclosures_for_law_enforcement_purposes/505.html. 
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to  court  orders,  mandated  reporting  of  sexual  or  physical  abuse,  and  notification  of  when 
a  patient  dies.21 

Various  federal  laws  define  the  government’s  role  and  responsibilities  in  regards 
to  national  security  (i.e.,  the  National  Security  Act  and  the  Patriot  Act).  These  laws  define 
terms  and  delineate  the  circumstances  in  which  a  practitioner  may  report  behavior  that 
endangers  national  security.22  For  example,  Section  215  of  the  PATRIOT  Act  describes 
the  process  through  which  the  federal  government  may  require  practitioners  to  provide 
the  FBI  with  evidence  of  national  intelligence,  counter-intelligence,  or  national  security 
implications.23 


3.  Confidentiality  versus  Public  Peril 

State  laws  inspired  by  the  1974  and  1976  Tarasoff  vs.  Regents  case  in  California 
affect  clinicians  and  their  duty  to  warn  or  protect  when  they  are  treating  a  client  who 
poses  a  risk  to  others.24  It  is  from  the  Tarasoff  case  that  the  terms  “duty  to  warn”  and 
“duty  to  protect”  originate.25  Tarasoff  was  the  first  case  to  explore  the  balance  between  a 
patient’s  right  to  confidentiality  and  a  therapist’s  obligation  to  warn  third  parties  of 
potential  danger  posed  by  the  client 26  The  requirement,  which  has  been  adopted  and 
applied  by  most  states,  requires  that  psychotherapists  with  information  that  a  client  they 
are  treating  poses  a  threat  to  someone  else  make  reasonable  efforts  to  communicate  with 


21  “When  Does  the  Privacy  Rule  Allow  Covered  Entities  to  Disclose  Protected  Health  Information  to 
Law  Enforcement  Officials?.” 

22  F.  Sensenbrenner,  “H.R.2048— 1 14th  Congress  (2015-2016):  USA  FREEDOM  Act  of  2015,”  June 
2,  2015,  https://www.congress.gOv/bill/l  14th-congress/house-bill/2048/text. 

23  “National  Security  and  Medical  Information,”  accessed  March  26,  2016,  https://www.eff.org/ 
issues/national-security-and-medical-information. 

24  Tarasoff  v.  Regents  of  the  University  of  California,  17  Cal.  3d  425  (1976). 

25  Steven  Granich,  “Duty  to  Warn,  Duty  to  Protect,”  SocialWorker.com,  accessed  February  27,  2016, 
http://www.socialworker.com/api/content/a89ea5ac-f455-31d0-b88f-d814ca06299f/. 

Damon  Muir  Walcott,  Pat  Cemndolo,  and  James  C.  Beck,  “Current  Analysis  of  the  Tarasoff  Duty: 
An  Evolution  towards  the  Limitation  of  the  Duty  to  Protect,”  Behavioral  Sciences  &  the  Law  19,  no.  3 
(June  2001):  325-43,  doi:10.1002/bsl.444. 
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and  warn  the  victim  and  a  LE  agency.27  Since  duty  to  warn  and  protect  laws  reside  at  the 
state  level,  each  state  has  a  unique  law  that  applies  the  duty  differently. 


C.  HYPOTHESIS 

CVE  intervention,  deflection,  and  diversion  programs  need  mental  health 
practitioners  to  conduct  an  assessment,  construct  a  treatment  plan,  and  provide  treatment. 
The  effort  needs  to  be  coordinated  among  professionals  from  various  fields. 
Relationships  and  communication  between  the  professionals  are  critical.  The  solution 
includes  an  understanding  of  the  laws  that  facilitate  or  restrict  disclosure  of  confidential 
health  information  combined  with  structured  teams  to  oversee  the  process. 

In  Montgomery  County,  Maryland,  detectives  assigned  to  the  County  Police 
Department’s  Special  Victim  Investigative  Division  Child  Abuse  Units  work  hand  in 
hand  with  social  workers  from  the  County’s  Child  Protective  Services  division.  The 
detectives  and  social  workers  conduct  joint  investigations  into  the  reports  of  physical  and 
sexual  child  abuse.  In  some  cases,  where  the  victim  is  younger,  the  specially  trained 
social  workers  conduct  the  interview  of  the  victim.  The  social  workers  and  detectives  are 
also  part  of  a  larger  team  of  practitioners  who  all  have  an  interest  in  the  investigation  and 
coordination  of  services  to  the  victims  and  their  families.  The  larger  team  includes 
specially  trained  medical  personnel  (pediatrician  and  nurse),  prosecutors  from  the  state’s 
attorney’s  office,  and  lawyers  from  the  county  attorney’s  office.  The  team  meets  once  a 
week  (as  needed)  to  collaborate  on  cases  that  need  special  attention.  The  meetings,  called 
“multi-d’s,”  are  the  fonnal  collaborative  efforts  of  an  entire  multi-disciplinary  team. 
Members,  who  have  identified  an  issue,  or  problem,  call  the  meeting  to  bring  together  the 
collective  expertise  of  the  members  to  solve  any  issues.  During  the  meeting,  members 
work  together  to  identify  issues  and  create  solutions.  Over  the  years,  the  members  of  the 
teams  have  developed  a  strong  working  relationship,  which  has  led  to  an  understanding 
and  appreciation  for  the  roles  of  the  other  members  of  the  team. 


27  Bonnie  R.  Benitez,  “Confidentiality  and  Its  Exceptions  (including  the  U.S.  Patriot  Act),”  The 
Therapist  16,  no.  4  (2004):  32-36. 
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Collaborative  efforts  designed  to  address  complex  issues  frequently  organize  into 
structures  that  have  proven  to  overcome  challenges.  CIIs  and  multi-disciplinary  teams 
(MDTs)  are  two  examples  of  such  structures.  Each  model  was  designed  to  bring  together 
practitioners  from  different  disciplines  to  accomplish  a  shared  goal.  The  structures 
facilitate  a  mutual  understanding  of  roles  and  ensure  communication  and  cooperation 
between  the  different  elements  of  the  group,  thus  ensuring  a  higher  probability  of 
success.  CIIs  are  best  deployed  at  the  organization  level,  and  MDTs  are  best  utilized  at 
the  sub-group  level.  CVE  programs  should  analyze  the  concepts  inherent  in  both 
programs.  CVE  programs  may  benefit  from  the  structure  of  a  CII.  Smaller  working 
groups,  such  as  those  managing  and  facilitating  intervention  efforts,  should  operate  as  a 
MDT.  The  collaborative  group  and  the  tenets  of  the  structure  should  then  be  used  to 
ensure  proper  training  on  laws  and  policies  applicable  to  the  overall  missions  of  the 
program. 

Although  the  response  to  child  abuse  and  radicalization  are  different,  it  is  possible 
to  apply  methods  that  have  proven  successful  to  CVE.  CIIs  and  MDTs  may  be  used  to 
identify  and  solidify  roles,  create  trusting  partnerships,  study  policy,  and  manage  the 
screening  and  creation  of  treatment  plans  for  clients  in  CVE  intervention  programs.  The 
use  of  a  MDT  to  oversee  efforts  would  ensure  that  all  members  of  the  team  were 
educated  on  the  laws  that  apply  to  the  effort,  and  that  proper  communication  between 
team  members  occurred.  The  strength  of  the  model  lies  in  the  melting  together  of 
different  disciplines  that  all  have  a  role  in  the  effort. 

Once  practitioners  have  formed  into  CIIs  and  MDTs,  the  identification  and 
execution  of  roles  and  responsibilities  may  begin.  Legal  experts  may  begin  determining 
the  path  forward  and  policies  may  be  constructed.  As  the  effort  progresses  and  additional 
issues  arise,  a  team  of  experts  would  already  exist  to  analyze  and  address  the  issues. 

D.  LITERATURE  REVIEW 

The  U.S.  CVE  program  was  designed  to  apply  to  local  levels  of  government  with 
the  support  of  the  federal  government.  The  main  goal  of  the  program  is  to  “prevent 
violent  extremists  and  their  supporters  from  inspiring,  radicalizing,  financing,  or 
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recruiting  individuals  or  groups  in  the  United  States  to  commit  acts  of  violence.”28  In 
locations  where  CVE  programs  exist,  not  all  aspects  of  the  program  have  been 
implemented.  As  a  result,  a  fair  amount  of  research  has  been  conducted  on  CVE  in 
general,  but  little  current  research  is  available  on  CVE  programs  presently  in  place,  and 
specifically,  no  research  on  CVE  intervention  or  diversion  programs.  The  lack  of  metrics 
associated  with  measuring  the  success  of  CVE  programs,  and  the  need  for  continuous 
studies  on  CVE  efforts  have  been  raised  by  researchers.29 

As  threats  against  the  homeland  develop,  the  response  to  those  threats  evolves.  As 
a  result,  the  landscape  is  constantly  changing.  This  literature  review  is  divided  into  the 
following  categories: 

•  The  U.S.  CVE  program 

•  Current  CVE  models 

•  National  security  laws  and  confidentiality 

•  The  multidisciplinary  approach 

1.  U.S.  CVE  Program 

The  2011  federal  government  report  titled,  Empowering  Local  Partners  to 
Prevent  Violent  Extremism  in  the  United  States,  defines  violent  extremists  as  “individuals 
who  support  or  commit  ideologically-motivated  violence  to  further  political  goals.”  The 
report  identifies  the  central  goal  of  CVE  as  “prevent[ing]  violent  extremists  and  their 
supporters  from  inspiring,  radicalizing,  financing,  or  recruiting  individuals  or  groups  in 
the  United  States  to  commit  acts  of  violence.”31 


28  Executive  Office  of  the  President  of  the  United  States,  Empowering  Local  Partners  to  Prevent 
Violent  Extremism  in  the  United  States. 

29  NameenChowdhury  Fink,  Peter  Romaniuk,  and  RafiaBarakat,  Evaluating  Countering  Violent 
Extremism  Programming:  Practice  and  Progress  (New  York:  Center  on  Global  Counterterrorism 
Cooperation,  2013),  http://globalcenter.org/wp-content/uploads/2013/07/Fink_Romaniuk_Barakat_ 
EVALUATING-CVE-PROGRAMMING_20132.pdf. 

39  Executive  Office  of  the  President  of  the  United  States,  Empowering  Local  Partners  to  Prevent 
Violent  Extremism  in  the  United  States,  1. 

31  Ibid.,  3. 
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Several  months  later,  the  federal  government  issued  a  second  report,  titled,  The 
Strategic  Implementation  Plan  (SIP)  for  Empowering  Local  Partners  to  Prevent  Violent 
Extremism  in  the  United  States ,32  The  SIP  identified  a  three-part  strategy  to  implement 
CVE  programs  as  increasing  support  for  local  communities,  expanding  governmental 
knowledge,  and  providing  counter-narratives.33  These  two  reports  provide  a  roadmap  of 
the  federal  government’s  intent  for  its  CVE  program.  These  types  of  reports  issued 
directly  by  the  federal  government  are  primary  sources;  the  remaining,  secondary 
literature,  provides  an  analysis  and  evaluation  of  the  plans. 

Many  of  the  sources  that  provide  an  analysis  of  the  federal  CVE  program  have 
come  to  similar  conclusions  and  have  identified  similar  criticisms,  or  areas  of  interest  in 
which  lie  opportunities  for  improvement.  The  fact  that  different  experts  who  represent  a 
variety  of  organizations  have  drawn  the  same  conclusions  may  lend  a  certain  amount  of 
credibility  to  the  findings.  For  example,  a  report  issued  by  the  federal  Congressional 
Research  Service  (CRS)  and  a  report  issued  by  the  Heritage  Foundation  both  recognized 
that  the  federal  govermnent  had  not  selected  a  lead  agency  for  the  implementation  and 
management  of  CVE,  and  that  it  was  an  area  of  concern  that  needed  to  be  addressed.34  In 
this  case,  both  a  federal  agency  and  a  non-governmental  organization  (NGO)  arrived  at 
the  same  conclusion  in  regards  to  CVE.  Since  then,  the  federal  government  has 
consolidated  many  of  its  efforts  under  the  Department  of  Homeland  Security  (DHS). 
Other  federal  agencies,  such  as  the  FBI  and  the  U.S.  Attorney’s  Office,  are  still  involved 
in  different  areas. 

Virtually  all  the  research  on  CVE  identifies  problem  areas  within  the  model  and 
its  implementation:  a  lack  of  funding,  an  absence  of  a  lead  agency,  the  lack  of  a  clear 
definition  for  CVE,  hurdles  associated  with  community  engagement  and  trust,  the 

32  Executive  Office  of  the  President  of  the  United  States,  Strategic  Implementation  Plan  for 
Empowering  Local  Partners  to  Prevent  Violent  Extremism  in  the  United  States,  2011. 

33  Ibid. 

34  Jerome  P.  Bjelopera,  Countering  Violent  Extremism  in  the  United  States  (CRS  Report  No.  R42553) 
(Washington,  DC:  Congressional  Research  Service,  2012),  http://digital.library.unt.edU/ark:/67531/metadc 
87235/ml/l/high_res_d/R42553_2012May31.pdf;  David  Inserra,  “Revisiting  Efforts  to  Counter  Violent 
Extremism:  Leadership  Needed,”  The  Heritage  Foundation,  April  20,  2015,  http://www.heritage.org/ 
research/reports/20 15/04/revisiting-efforts-to-counter-violent-extremism-leadership-needed. 
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stigmatization  of  the  Muslim  community,  a  lack  of  effort  aimed  at  other  populations 
vulnerable  to  radicalization,  and  a  lack  of  empirical  research  to  provide  policy  makers 
with  information  for  decision  making. 

Since  September  11,  2001,  the  United  States  has  experienced  acts  of  violence 
committed  by  individuals  who  have  been  radicalized  to  violent  extremism.  According  to 
a  report  issued  by  the  CRS,  an  estimated  63  homegrown  violent  jihadist  plots  or  attacks 
have  occurred  in  the  United  States  between  September  11,  2001  and  20 13. 35 

Many  of  the  individuals  who  committed  these  acts  were  considered  HVEs  who 
had  undergone  a  radicalization  process.  According  to  Bjelopera,  “‘homegrown’  is  the 
term  that  describes  terrorist  activity  or  plots  perpetrated  within  the  United  States  or 
abroad  by  American  citizens,  legal  permanent  residents,  or  visitors  radicalized  largely 
within  the  United  States.”36 

In  this  context,  radicalization  refers  to  the  process  in  which  an  individual  acquires 
and  internalizes  extremist  or  jihadist  beliefs.37  Experts  agree  that  the  process  of 
radicalization  may  contain  some  similarities  for  some  individuals,  but  that  currently  no 
solid  pattern  exists  since  it  is  an  individualized  event.  The  process  may  be  affected  by 
outside  influences,  such  as  intermediaries,  social  networks,  the  Internet,  or  contact  with 
others  in  prison.38  Even  though  the  radicalization  process  is  unique  to  each  individual, 
case  studies  are  beneficial  to  identifying  markers  displayed  by  other  individuals  in  the 
process  of  radicalizing. 

“The  term  ‘jihadist’,”  notes  Bjelopera,  “describes  radicalized  individuals  using 
Islam  as  an  ideological  and/or  religious  justification  for  their  belief  in  the  establishment 
of  a  global  caliphate,  or  jurisdiction  government  by  a  Muslim  civil  and  religious  leader 


33  Jerome  Bjelopera,  American  Jihadist:  Terrorism  Combating  a  Complex  Threat  (CRS  Report  No. 
R41416)  (Washington,  DC:  Congressional  Research  Service,  2013),  1,  https://www.fas.org/sgp/crs/terror/ 
R41416.pdf. 

36  Ibid. 

37  Ibid. 

38  Ibid.,  2. 
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known  as  a  caliph.”39  The  federal  government  defines  violent  extremists  as  “individuals 
who  support  or  commit  ideologically-motivated  violence  to  further  political  goals.”40 
Examples  of  terror  acts  committed  by  homegrown  individuals  who  had  radicalized  to 
extremist  violence  include  the  Fort  Hood  shooting  and  the  Boston  Marathon  bombing.41 

Historically,  the  government’s  response  to  terrorist  acts  committed  or  planned  on 
U.S.  soil  has  involved  traditional  LE  and  intelligence  activities.  These  activities  include 
gathering  and  analyzing  information,  traditional  investigative  techniques,  and 
prosecutions.  These  efforts  are  conducted  by  LE  and  intelligence  agencies  at  the  federal, 
state,  and  local  levels.  According  to  a  2010  report  by  the  RAND  Corporation: 

Traditional  law  enforcement,  in  which  authorities  attempt  to  identify  and 
apprehend  a  perpetrator  after  a  crime  has  been  committed,  is  inadequate  to 
deal  with  terrorists  who  are  determined  to  cause  many  deaths  and  great 
destruction  and  who  may  not  care  whether  they  themselves  survive.  Public 
safety  demands  a  more  preventative  approach,  intervention  before  an 
attack  occurs.42 

In  October  2016,  the  U.S.  government  released  an  updated  SIP,  which  addresses 
many  of  the  broad  criticisms  of  the  CVE  program  43  The  2016  SIP  re-enforces  the  goals 
of  CVE  programs,  and  states,  “The  overall  goal  of  the  Strategy  and  United  States 
Government  efforts  to  implement  it  remains  unchanged:  to  prevent  violent  extremists  and 
their  supporters  from  inspiring,  radicalizing,  financing,  or  recruiting  individuals  or  groups 


39  Ibid.,  1. 

40  Executive  Office  of  the  President  of  the  United  States,  Empowering  Local  Partners  to  Prevent 
Violent  Extremism  in  the  United  States,  1. 

41  For  more  information  on  these  events,  please  refer  to  Joseph  Lieberman  and  Susan  Collins,  A 
Ticking  Time  Bomb  Counterterrorism  Lessons  from  the  U.S.  Government’s  Failure  to  Prevent  the  Fort 
Hood  Attack  (Washington,  DC:  U.S.  Senate  Committee  on  Homeland  Security  and  Governmental  Affairs, 
2011),  http://fas.org/irp/congress/2011_rpt/hsgac-hood.pdf;  “Boston  Marathon  Bombings,”  accessed  July  8, 
2015,  http://www.boston.com/news/locaFmassachusetts/specials/boston_marathon_bombing/. 

42  Brian  Michael  Jenkins,  Would-Be  Warriors:  Incidents  of  Jihadist  Terrorist  Radicalization  in  the 
United  States  since  September  11,  2001( Santa  Monica,  CA:  RAND,  2010),  viii,  http://www.rand.org/ 
content/dam/rand/pubs/occasional_papers/2010/RAND_OP292.pdf. 

43  Executive  Office  of  the  President  of  the  United  States,  Strategic  Implementation  Plan  for 
Empowering  Local  Partners  to  Prevent  Violent  Extremism  in  the  United  States  (Washington,  DC: 

Executive  Office  of  the  President  of  the  United  States,  2016),  https://www.whitehouse.gov/sites/default/ 
files/docs/201 6_strategic_implementation_plan_empowering_local_partners_prev.pdf. 
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in  the  United  States  to  commit  acts  of  violence.”44  The  current  SIP  also  recognizes  that 
no  single  path  to  radicalization  is  followed  and  the  phenomenon  is  not  exclusive  to  any 
one  population,  religion,  or  cause.  The  introduction  to  the  current  SIP  also  provides 
clarity  to  the  tenn  “stakeholder”  in  relation  to  CVE  programs.  The  document  describes 
stakeholders  as  persons  who  have  an  “expressed  or  identified  role”  in  CVE  and  may 
include  LE,  members  of  the  public,  NGOs,  researchers,  members  of  the  education  field, 
mental  health  practitioners,  and  efforts  provided  by  private-sector  experts.45 

The  new  SIP  addresses  previous  criticism  of  the  federal  CVE  model’s  lack  of  a 
lead  agency  by  assigning  a  DHS  task  force  as  the  lead  government  agency  in 
coordinating  research  and  the  dissemination  of  information.  “Its  work  is  organized  into 
four  lines  of  effort:  Research  and  Analysis;  Engagement  and  Technical  Assistance; 
Interventions;  and  Communications  and  Digital  Strategy.”46 

The  current  SIP  identified  intervention  as  one  of  the  four  areas  of  concentration 
for  the  DHS  task  force.  The  document  states  that  the  task  force,  “will  coordinate  the 
development  and  dissemination  of  resources  describing  possible  warning  signs  as  well  as 
steps  families  and  friends  can  take  if  they  believe  someone  close  to  them  is  becoming 
recruited  or  radicalized  to  violence.”47 

Counter-radicalization  programs  are  typically  divided  into  three  different  types  of 
efforts:  prevention  (intervention),  disengagement  (deflection),  and  de-radicalization 
(diversion).  Prevention  involves  education  and  counter-narrative  efforts  designed  to  stop 
the  radicalization  process  before  it  begins.  These  efforts  may  involve  an  intervention 
aspect  for  individuals  who  have  been  referred  to  a  program  after  a  determination  has  been 
made  that  the  individual  may  be  vulnerable  or  susceptible  to  a  radicalization  process. 
Disengagement  or  deflective  efforts  are  designed  to  provide  an  “off  ramp”  for  individuals 
engaged  in  a  radicalization  process.  De-radicalization  or  diversion  programs  are  designed 


44  Ibid.,  1. 

45  Executive  Office  of  the  President  of  the  United  States,  Empowering  Local  Partners  to  Prevent 
Violent  Extremism  in  the  United  States,  1. 

46  Ibid.,  2. 

47  Ibid.,  11. 
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to  lead  a  radicalized  individual  to  abandon  violent  or  deviant  views  and  return  to  regular 
society.  A  successful  outcome  of  disengagement  and  de-radicalization  activities  may 
include  an  individual  maintaining  radical  views,  but  abandoning  violent  activities.48  All 
these  activities  and  phases  fall  under  the  general  rubric  of  “intervention.” 

2.  Current  CVE  Models 

Several  years  after  the  U.S.  government  began  planning  a  CVE  program,  efforts 
stalled.  After  the  Boston  Marathon  Bombing  and  the  rise  of  the  IS,  interest  in  the 
program  was  renewed.49  Former  Attorney  General  Eric  Holder  announced  in  September 
2014  that  CVE  efforts  would  be  focused  on  three  cites,  which  were  identified  as  Boston, 
Los  Angeles,  and  Minneapolis-St.  Paul.  The  “Three  City  Pilot”  effort  tasked  authorities 
in  those  cities  with  developing  local  CVE  programs  targeting  IS-related  radicalization.50 
The  three  pilot  cites  were  chosen  by  the  federal  government  based  on  their  “existing 
achievements  with  community  engagement.”51  A  fourth  program  was  developed  in 
Montgomery  County,  Maryland,  by  a  NGO  in  partnership  with  local  government. 

A  search  for  literature  on  the  four  models  yields  primary  source  information 
released  by  various  stakeholder  panels  enacted  by  the  local  jurisdictions  to  create  and 
implement  the  CVE  models.  For  example,  Boston  and  Los  Angeles  both  released 
documents,  referred  to  as  “frameworks,”  outlining  their  plans  for  the  creation  and 
implementation  of  their  CVE  models.52  The  frameworks  clearly  describe  the  intended 


48  Lorenzo  Vidino,  Countering  Radicalization  in  America  (Washington,  DC:  United  States  Institute  of 
Peace,  2010),  2,  http://dspace.africaportal.Org/jspui/bitstream/123456789/31361/l/SP%20262-%20Counter 
ing%20%20Radicalization%20in%20America.pdf. 

49  Lorenzo  Vidino  and  Seamus  Hughes,  Countering  Violent  Extremism  in  America  (Washington,  DC: 
Center  for  Cyber  and  Homeland  Security:  The  George  Washington  University,  2015),  https://cchs.gwu.edu/ 
sites/cchs.gwu.edu/files/downloads/CVE%20in%20Ameri  ca%20.pdf. 

59  “Pilot  Programs  Are  Key  to  Our  Countering  Violent  Extremism  Efforts,”  February  18,  2015, 
http://www.justice.gov/opa/blog/pilot-programs-are-key-our-countering-violent-extremism-efforts. 

51  Ibid. 

52  U.S.  Attorney’s  Office  District  of  Massachusetts,  A  Framework  for  Prevention  and  Intervention 
Strategies:  Boston  CVE  Framework  (Boston:  U.S.  Attorney’s  Office  District  of  Massachusetts,  2015), 
http://www.justice.gov/sites/default/files/usao-ma/pages/attachments/2015/02/18/framework.pdf;  Los 
Angeles  Interagency  Coordination  Group,  Los  Angeles  Framework  for  CVE-Full  Report  (Los  Angeles:  Los 
Angeles  Interagency  Coordination  Group,  2005),  http://www.dhs. gov/sites/default/files/publications/Los% 
20Angeles%20Framework%20for%20CVE-Full%20Report.pdf. 
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parts  of  the  models  and  identified  their  goals.  Several  fact  sheets  on  the  pilot  cities’  CVE 
programs  were  issued  by  the  federal  government.  The  Minneapolis-St.  Paul  team  did  not 
issue  a  framework  document,  but  a  fact  sheet  does  exist.53  Additionally,  numerous 
articles  from  media  sources  are  available  on  the  pilot  cities  programs,  but  the  majority  of 
the  infonnation  is  taken  from  the  releases  provided  by  the  programs  themselves.  The 
fourth  program,  located  in  Montgomery  County,  Maryland,  and  known  as  the 
Montgomery  County  Model  (MCM),  has  also  released  information  on  its  program,  which 
identifies  the  parts  and  goals  of  the  program.  Recently,  the  MCM  has  expanded  to  other 
jurisdictions.  As  a  result,  the  name  of  the  program  has  changed  to  Building  Resilience 
Against  Violent  Extremism  (BRAVE).  In  the  summer  of  2016,  BRAVE  released  a  three- 
year  strategic  plan  outlining  recommendations  and  future  growth.54 

The  MCM  of  CVE  is  the  first  community  based  and  led  CVE  model  in  the 
country.  The  model  was  developed  by  the  WORDE,  which  is  a  NGO.  According  to 
WORDE’s  director,  Dr.  Hedieh  Mirahmadi,  the  MCM  was  designed  to  be  a  community- 
led,  public-private  partnership  rooted  in  interfaith  collaboration.55  WORDE  has  partnered 
with  the  Montgomery  County  Police  (MCP)  Department  and  the  Montgomery  County 
Executive’s  Office  of  Community  Partnerships.  The  MCM  is  tied  to  the  Office  of 
Community  Partnerships’  Faith  Community  Working  Group  (FCWG).  The  FCWG  is 
composed  of  faith-based  community  leaders,  the  MCP,  trauma-infonned  counselors, 
youth  activists,  and  violence  prevention  experts.  “The  success  of  the  program  relies  on  a 
trusting  relationship  among  local  police,  schools,  health  and  human  services  agencies, 
and  the  faith  community,  whereby  persons,  who  may  be  radicalized,  regardless  of  the 


53  United  States  Attorney’s  Office,  Minneapolis-St  Paul  Building  Community  Resilience  Program- 
Pilot  Fact  Sheet  (Minneapolis,  MN:  United  States  Attorney’s  Office,  2015),  http://www.dhs.gov/sites/ 
defaiilt/files/publications/Minneapolis-St%20Paul%20Biiilding%20Community%20Resilience%20 
Program-Pilot%20Fact%20Sheet.pdf. 

54  World  Organization  for  Resource  Development  and  Education  (WORDE),  The  Building  Resilience 
against  Violent  Extremism  (BRAVE)  Model — A  Collective  Impact  Initiative  That  Increases  Public  Safety 
and  Social  Cohesion. 

55  George  J.  Selim  et  al.,  “New  Strategies  for  Countering  Homegrown  Violent  Extremism,”  The 
Washington  Institute  for  Near  East  Policy ,  November21,  2013,  http://www.washingtoninstitute.org/policy- 
analysis/view/new-strategies-for-countering-homegrown-violent-extremism. 
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reason,  are  identified  as  possibly  benefiting  from  an  intervention.”56  The  goal  of  the 
MCM  is  to  educate  the  public  and  governmental  organizations  on  the  risk  factors 
associated  with  violent  extremism,  and  then  to  refer  the  appropriate  resources  to 
intervene  with  the  at-risk  individuals  before  they  progress  down  a  path  to  radicalized 
violence.57 

Studies  on  the  different  CVE  models  are  being  conducted  by  such  institutions  as 
the  National  Institute  of  Justice  (NIJ)  and  the  Police  Executive  Research  Forum  (PERF), 
and  one  study  of  the  Minneapolis/St.  Paul  model  is  being  conducted  by  the  University  of 
Southern  California.58  It  is  expected  that  the  studies  will  provide  additional  infonnation 
on  the  differences  between  the  programs,  and  assist  in  identifying  any  strengths  and 
weaknesses  of  the  different  programs. 

3.  National  Security  Laws  and  Confidentiality 

Governments  in  democratic  countries  have  an  obligation  to  protect  themselves, 
their  citizens,  and  their  interests.  Federal  laws,  such  as  the  National  Intelligence  Act  and 
the  PATRIOT  Act  (and  since  2015,  its  successor,  the  USA  FREEDOM  Act)  spell  out  the 
U.S.  government’s  responsibility  and  authority.59  The  structure  of  these  laws  ensures  that 
protective  efforts  remain  balanced  with  the  protection  of  civil  liberties,  “The  governments 
of  free  societies  charged  with  fighting  a  rising  tide  of  terrorism  are  thus  faced  with  a 
democratic  dilemma:  If  they  do  not  fight  terrorism  with  the  means  available  to  them,  they 
endanger  their  citizenry;  if  they  do,  they  appear  to  endanger  the  very  freedoms  which 


56  Hedieh  Mirahmadi,  “An  Innovative  Approach  to  Countering  Violent  Extremism,”  The  Washington 
Institute  for  Near  East  Policy,  October  9,  2013,  http://www.washingtoninstitute.org/policy-analysis/view/ 
an-innovative-approach-to-countering-violent-extremism  1 . 

57  “The  Montgomery  County  Model,”  accessed  July  27,  2015,  http://www.dhs.gov/sites/default/fdes/ 
publications/Montgomery%20County%20MD%20Community%20Partnership%20Model-WORDE%20 
Report.pdf. 

58  National  Center  of  Excellence  for  Risk  and  Economic  Analysis  of  Terrorism  Events  (CREATE), 
Foreign  Fighters:  Terrorist  Recruitment  and  Countering  Violent  Extremism  in  Minneapolis-St.  Paul  (Los 
Angeles,  CA:  University  of  Southern  California,  2015),  http://securitydebrief.com/wp-content/uploads/ 
2015/04/Foreign-Fighters-Terrorist-Recruitment-and-CVE-in-Minneapolis-St-Paul.pdf. 

59  National  Security  Act  of 1947,  50  U.S.C.  401,  1947,  https://www.ncsc.gov/training/resources/ 
nsaactl947.pdf;  Lou  Ann  Wiedemann,  “Flomeland  Security  Act,  Patriot  Act,  Freedom  of  Information  Act, 
and  HIM  (2010  Update),”  Journal  of  AHIMA,  November  2010,  http://bok.ahima.org/doc7okU106172. 
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they  are  charged  to  protect.”60  This  balance  has  sometimes  been  described  as  a  pendulum 
that  swings  toward  security  in  times  of  danger,  and  then  back  towards  civil  liberties  and 
increased  freedom  during  times  of  peace,  “Thus  it  seems  that  the  democracies  are 
destined  to  wander  to  and  fro  between  the  poles  of  too  much  liberty  and  too  extensive  a 
security  effort,  walking  the  fine  line  between  security  and  freedom.”61  An  argument  can 
be  made  that  freedom  is  not  possible  under  threatening  conditions.  A  counter  argument 
may  be  made  that  freedom  trumps  all.  Balancing  and  ensuring  both  is  the  responsibility 
of  the  government  and  the  people.  Free  speech,  a  free  press,  courts,  and  elections  are  all 
part  of  the  balancing  process.  Laws,  and  granting  power  to  government  agencies,  provide 
the  counterbalance. 

After  WWII,  and  at  the  beginning  of  the  Cold  War,  the  U.S.  government  enacted 
the  National  Security  Act,  which  called  for  a  major  re-organization  of  the  military  and 
intelligence  community.62  The  Act  defines  intelligence  as  all  information  that  involves 
threats  to  the  country,  its  citizens,  property,  or  interests.  Intelligence  is  also  defined  as 
anything  having  to  do  with  the  proliferation  of  weapons  of  mass  destruction,  or  any  other 
matter  affecting  U.S.  national  or  homeland  security.  The  use  of  the  term  homeland 
security  seems  like  a  newer  phenomenon,  but  it  was  actually  used  in  this  sweeping 
legislation  in  1947.  The  National  Security  Act  begins  to  define  authority  and 
responsibility  in  reference  to  intelligence  issues.  Executive  Orders  (EOs)  are  legal  entities 
that  describe  how  other  laws  will  be  applied  to  various  entities  within  the  government. 

In  addition  to  the  major  re-structuring  of  government,  and  the  creation  of  the 
Central  Intelligence  Agency,  the  National  Security  Act  laid  the  groundwork  for  the 
government’s  framework  for  providing  today’s  national  security  efforts  and  a  base  upon 
which  future  laws  would  be  built.  EO  12333,  issued  by  President  Ronald  Reagan,  is  good 


60  Benjamin  Netanyahu,  Fighting  Terrorism:  How  Democracies  Can  Defeat  Domestic  and 
International  Terrorism,  2001st  ed.  (New  York:  Farrar,  Straus,  and  Giroux,  1995),  67. 

61  Netanyahu,  Fighting  Terrorism:  How  Democracies  Can  Defeat  Domestic  and  International 
Terrorism,  99. 

62  “Truman  Signs  the  National  Security  Act-Jul  26,  1947,”  accessed  August  14,  2016,  http://www. 
history.com/this-day-in-history/truman-signs-the-national-security-act. 
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63 

example  of  a  legal  action  building  upon  the  National  Security  Act.  The  EO  defines  and 
relegates  the  duty  of  civilian  intelligence  and  counter-intelligence  responsibilities  in  the 
homeland  to  the  FBI.  The  EO  also  affirms  the  government’s  right  to  collect  and  use 
intelligence  on  U.S.  persons,  and  mandates  that  the  methods  be  the  least  intrusive  as 
possible.  It  also  delegates  the  oversight  process  to  various  entities  within  the  government. 

In  short,  the  National  Security  Act  and  the  EO,  which  clarifies  roles  and  methods, 
provides  the  U.S.  government  with  the  authority  to  protect  the  country,  its  citizens,  and 
interests  by  collecting  and  using  intelligence.  A  separation  of  powers  was  developed  in 
which  nonnal  intelligence  agencies  are  aimed  outside  of  the  United  States,  and  the  FBI  is 
relegated  with  the  authority  as  a  civilian  LE  agency  to  conduct  protective  investigations 
on  U.S.  soil,  although  the  reach  of  the  FBI  extends  oversees. 

The  PATRIOT  Act  is  another  example  of  sweeping  legislation  in  response  to  a 
major  national  security  event.64  The  Act  was  the  largest  re-organization  of  this  nation’s 
federal  government  since  the  National  Security  Act.  The  expedited  creation  of  the  Act 
and  the  scope  of  its  change  are  both  notable.  In  addition  to  a  large  scale  re-organization 
and  the  creation  of  the  DHS,  it  is  also  important  to  recognize  that  the  Act  is  aimed 
directly  at  terrorism  targeting  the  U.S.  homeland.  As  a  result,  the  Act  both  focuses  and 
increases  the  government’s  ability  to  collect,  use,  and  store  intelligence. 

Some  of  the  authority  vested  in  the  government  by  the  Act  has  created 
controversy.  Some  of  this  controversy  has  bled  over  into  the  realm  of  CVE.  Specifically, 
Section  215  of  the  Patriot  Act  has  received  a  significant  amount  of  criticism  for  the  broad 
power  it  granted  the  government  in  collecting  data  on  U.S.  citizens.65  Much  of  the  debate 
has  surrounded  the  ability  the  section  granted  the  National  Security  Agency  to  monitor 
and  collect  electronic  data.  The  public  response  to  this  aspect  of  the  Act  has  been  used  by 
some  to  fuel  discontent  in  other  areas. 

63  “Executive  Order  12333 — United  States  Intelligence  Activities,”  accessed  August  15,  2016,  http:// 
www.archives.gov/federal-register/codification/executive-order/12333.html. 

64  “What  Is  the  USA  Patriot  Act:  Preserving  Life  and  Liberty,”  accessed  August  20,  2016,  https:// 
www.justice.gov/archive/ll/highlights.htm. 

65  “Law  Enforcement  &  National  Security  Access  to  Medical  Records,”  July  11,  2013,  https://cdt.org/ 
insight/law-enforcement-national-security-access-to-medical-records/. 
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Some  of  the  literature  used  for  this  thesis  connects  the  government’s  collection  of 
data  to  confidential  personal  infonnation  in  the  field  of  psychotherapy.66  According  to  a 
2004  article  from  The  Therapist,  concern  has  arisen  within  the  field  of  psychotherapy  that 
the  PATRIOT  Act,  in  particular  Section  215,  grants  the  government  carte  blanche  to 
collect  personal  health  information  (PHI).  Expressly,  claims  have  been  made  that  the 
section  allows  the  FBI  to  require  therapists  to  turn  over  “books,  records,  papers, 
documents,  and  other  items,”  while  at  the  same  time,  prohibiting  the  therapist  from 
advising  the  patient  that  the  government  was  seeking  or  obtaining  the  information.67 
These  claims  are  technically  true,  but  not  at  all  a  new  development.  The  FBI  and  other 
LE  agencies  have  always  been  able  to  collect  information  as  part  of  criminal 
investigations. 

The  law  has  always  had  checks  and  balances  and  provided  oversight  for  the 
process.  Investigators  must  possess  a  certain  level  of  proof  (probable  cause),  articulate 
the  proof  in  a  sworn  document  (search  warrant),  and  receive  approval  from  a  judge 
(oversight)  to  seize  infonnation  (or  anything  else  of  an  evidentiary  nature).  None  of  these 
legal  requirements  are  new,  expanded,  or  out  of  the  ordinary.  It  should  also  be  noted  that 
the  Act  does  not  require  mandatory  notification  of  the  government  by  therapists,  or 
anyone  else. 

One  point  of  possible  concern  is  Section  215,  and  the  collection  of  infonnation. 
Section  215  makes  changes  to  the  Foreign  Intelligence  Surveillance  Act  (FISA),  which 
allows  for  the  FBI  director,  or  designee,  to  apply  for  a  court  order  to  seize  PHI  through 
the  Foreign  Intelligence  Court  (FISC).68  While  the  FISC  provides  the  same  oversight 
over  4th  Amendment  search  and  seizure  issues  as  regular  courts  and  magistrates,  it  adds  a 
layer  of  secrecy  to  the  proceedings.  The  secret  nature  of  the  FISC  was  necessary  due  to 
the  court’s  original  purpose  as  an  oversight  of  foreign  intelligence  investigations.  The 
court  serves  as  a  balance  of  oversight  and  secrecy  to  protect  the  integrity  of  counter- 

66  Benitez,  “Confidentiality  and  Its  Exceptions  (Including  the  U.S.  Patriot  Act),”  32-36. 

67  “FAQ  on  Government  Access  to  Medical  Records,”  accessed  August  15,  2016,  https://www. 
aclu.org/faq-government-access-medical-records. 

68  “Law  Enforcement  &  National  Security  Access  to  Medical  Records.” 
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intelligence  investigations.  The  expansion  of  the  use  of  the  FISC  for  counter-terrorism 
investigations  serves  the  same  purposes.  While  the  oversight  remains  the  same,  it  is  more 
difficult  to  shine  the  light  of  public  oversight  to  FISC  proceedings.  “As  the  law  stands 
now,  the  federal  government  has  multiple  avenues  for  accessing  medical  records  by 
citing  national  security  considerations,  and  gag  provisions  in  the  Patriot  Act  make  it 
difficult  to  know  how  this  power  is  being  used.”69 

The  bottom  line  is  that  Section  215  of  the  Patriot  Act  expands  the  use  of  the  FISC 
to  include  investigations  of  domestic  terrorism.70  The  use  of  the  court  retains  the  same 
level  of  judicial  oversight  (perhaps  more)  as  other  judicial  venues  used  by  government 
investigators  to  have  search  and  seizure  warrants  issued.  Additionally,  the  nature  of  the 
system  has  not  changed  in  reference  to  the  ability  for  the  federal  government  to  use 
Section  215  for  a  “fishing  expedition.”71  The  opportunity  does  not  exist.  If  a  CVE 
practitioner  is  served  with  a  search  and  seizure  warrant  or  court  order  ordering  the  release 
of  PHI,  it  is  in  relation  to  an  investigation  of  a  serious  national  threat.  If  the  CVE 
practitioner  has  not  provided  the  government  with  the  information  that  was  used  to  open 
the  investigation,  and  the  government  developed  probable  cause  from  sources  not  related 
to  the  CVE  practitioner,  the  practitioner  has  no  choice  but  to  comply  with  the  warrant. 

4.  Multi-Disciplinary  Teams 

For  many  years,  different  fields  have  relied  on  multidisciplinary  efforts  to  find  the 
best  approach  to  shared  goals.  MDTs  are  typically  composed  of  a  group  of  professionals 
from  different  fields  who  share  a  common  purpose,  but  contribute  different  areas  of 
expertise  to  the  effort.72  By  this  definition,  CVE  efforts  are  already  a  fonn  of  MDT.  This 
thesis  studies  the  expansion  of  the  use  of  the  MDT  model  to  improve  cooperation  and 
communication  with  an  increased  set  of  practitioners  involved  in  CVE.  Since  MDTs  have 
existed  for  several  decades  and  been  used  in  multiple  fields,  sufficient  infonnation  exists 

69  “National  Security  and  Medical  Information.” 

70  “Law  Enforcement  &  National  Security  Access  to  Medical  Records.” 

71  “FAQ  on  Government  Access  to  Medical  Records.” 
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on  their  history  and  use.  MDTs  have  previously  been  successfully  used  to  address 
complex  issues.  Some  of  the  areas  where  MDTs  have  been  applied  (such  as  child  abuse 
investigations)  involve  many  of  the  same  professionals  involved  in  CVE  intervention 
programs.73  As  a  result,  the  focus  is  on  the  use  of  MDT  in  response  to  reports  of  child 
abuse  with  comparisons  made  to  the  adoption  of  the  use  to  CVE  in  an  expanded  capacity. 

The  FBI  has  suggested  its  own  version  of  an  MDT  in  the  fonn  of  shared 
responsibility  committees  (SCRs).74  The  federal  government  has  been  vague  in  the 
information  released  concerning  SRCs;  however,  the  public  response  from  certain  areas 
has  been  swift  and  strong.  Few  official  sources  are  available  that  document  the 
government’s  intent  or  use  of  SRCs,  while  ample  secondary  sources  exist  criticizing  the 
proposed  program.75  Research  for  this  thesis  provides  an  analysis  of  what  is  known  about 
the  SRCs,  a  comparison  to  other  MDT  processes,  and  a  recommendation  on  how  to  move 
forward. 


5.  Summary 

The  threat  to  the  United  States  represented  by  HVEs  is  constantly  evolving  partly 
because  of  the  pace  of  changes  in  other  parts  of  the  world.  For  example,  IS  currently  is 
considered  one  of  the  greatest  terror  threats,  yet  did  not  exist  just  several  years  ago.  As 
conditions  around  the  world  change  and  evolve,  the  threat  in  the  U.S.  homeland  continues 
to  transfonn.  The  fast  pace  at  which  technology  progresses  affects  how  terror  groups 
plan,  recruit,  communicate,  and  attack. 

In  response,  efforts  to  counter  violent  extremism  may  be  advancing  faster  than 
studies  and  research  on  the  policies  and  programs  can  be  completed.  The  use  of  CVE  in 
the  United  States  has  been  researched  for  several  years,  but  models  of  the  program  have 
only  begun  to  be  implemented  as  of  2016.  Studies  of  the  models  have  recently  been 


73“Multidisciplinary  Team,”  accessed  July  8,  2016,  http://www.nationalcac.org/about/multi-team.html. 

74  Murtaza  Hussain  and  Jenna  McLaughlin,  “FBI’s  ‘Shared  Responsibility  Committees’  to  Identify 
‘Radicalized’  Muslims  Raise  Alarms,”  The  Intercept,  April  9,  2016,  https://theintercept.com/2016/04/ 
09/fbis-shared-responsibility-committees-to-identify-radicalized-muslims-raises-alarms/. 

75  Julian  Hattem,  “Key  Dem  Wants  Watchdog  to  Probe  Little-known  FBI  Program,”  The  Hill,  April 
29,  2016,  http://thehill.com/policy/national-security/278223-key-dem-wants-watchdog-to-probe-fbi. 
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conducted  by  such  groups  as  the  NIJ  and  PERF.  Research  on  foreign  programs  is 
abundant,  but  is  not  the  focus  of  this  thesis  because  U.S.  laws  are  different  and  unique 
from  other  countries. 

Sufficient  information  exists  to  analyze  CVE  models,  intervention  or  diversion, 
and  to  conduct  a  legal  analysis  of  the  laws  that  affect  the  topics  of  confidentiality,  duty  to 
warn,  and  the  notification  of  the  proper  authorities  by  CVE  practitioners  when  they 
determine  a  threat  or  possible  threat  exists. 

E.  RESEARCH  DESIGN 

The  thesis  analyzed  the  two  major  legal  areas  that  affect  CVE  intervention, 
diversion,  and  deflection  (medical  record  confidentiality  and  the  duty  to  warn  or  protect) 
and  how  they  facilitate  or  restrict  practitioners  from  making  notification  to  authorities 
concerning  clients  who  remain  or  become  a  threat.  This  portion  of  the  thesis  takes  the 
form  of  a  legal  analysis  that  determines  the  meaning  of  the  cases  and  their  respective 
implications. 

The  goal  of  the  thesis  is  to  define  and  explain  the  space  in  which  diversion  and 
intervention  practitioners  must  operate  in  terms  of  the  ability  and  requirements  related  to 
their  duty  to  warn,  confidentiality,  and  national  security  exceptions.  The  output  from  the 
thesis  is  a  set  of  structural  recommendations  to  facilitate  intervention  efforts  by 
integrating  or  leveraging  organizational  models  already  in  use. 

CVE  practitioners  will  need  to  be  knowledgeable  in  medical  confidentiality  laws 
at  both  the  federal  and  state  levels  to  comply  and  understand  exceptions  to  the  laws. 
HIPAA’s  Privacy  Rule  is  analyzed,  and  Maryland  law  stands  in  for  state  law.  Most 
mental  health  providers  are  familiar  with  the  theory  of  duty  to  warn.  This  paper  explores 
the  cause  for  state  duty  to  warn  laws  and  apply  the  legal  theory,  and  specifically 
Maryland’s  laws,  to  CVE  related  intervention  programs.  Since  CVE  programs  are  a 
collaboration  of  practitioners  from  various  fields,  it  is  useful  for  all  involved  to 
understand  the  way  that  medical  confidentiality  and  duty  to  warn  laws  impact  the 
operations  of  CVE  intervention  programs.  The  paper  then  suggests  models  for 
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collaboration  that  may  be  applied  to  CVE  programs  as  a  whole,  and  work  groups 
consisting  of  members  from  different  disciplines. 
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II.  MEDICAL  RECORDS  AND  THE  THEORY  OF 
CONFIDENTIALITY 

A.  FEDERAL  PRIVACY  FRAMEWORK 

The  theory  of  confidentiality  in  health  care  may  be  traced  to  the  Hippocratic  Oath, 
which  states,  “What  I  may  see  or  hear  in  the  course  of  the  treatment  or  even  outside  of 
the  treatment  in  regard  to  the  life  of  men,  which  on  no  account  one  must  spread  abroad,  I 
will  keep  to  myself,  holding  such  things  shameful  to  be  spoken  about.”76  For  health  care 
practitioners,  confidentiality  is  both  an  ethical  and  a  legal  issue.  Confidentiality  is 
essential  for  the  treatment  of  both  physical  and  mental  health  issues,  but  as  Benitez 
reminds  us,  “Confidentiality  is  defined  as  a  restriction  on  the  volunteering  of  information 
outside  of  the  courtroom  setting,  not  to  be  confused  with  the  concept  of  psychotherapist- 
patient  privilege.”77  Privilege  is  a  legal  concept  that  involves  special  relationships 
between  such  practitioners  as  lawyers  and  medical  professionals  and  their  clients. 
Privilege  has  to  do  with  the  right  of  the  client  to  withhold  testimony  in  court  by  the 
individual  with  whom  they  hold  the  relationship.78  According  to  her  article  in  The 
Therapist  titled,  “Confidentiality  and  it  Exceptions  (Including  the  U.S.  Patriot  Act),” 
Benitez  explains  the  difference  between  confidentiality  and  privilege: 

These  terms  are  not  synonymous.  They  apply  in  different  circumstances 
and  are  addressed  in  separate  sections  of  law.  The  psychotherapist  patient 
privilege  affords  the  holder  of  the  privilege  (usually  the  patient)  the  right 
to  withhold  testimony  (your  testimony)  in  a  court  of  law.  The 
psychotherapist-patient  privilege  arises  from  the  special  relationship 
therapists  have  with  their  patients.  It  is  an  exception  to  the  general  rule 
that  requires  testimony  from  witnesses  who  are  subpoenaed  to  provide 
such  testimony.79 


76  Ask  a  Librarian,  “Guides:  Bioethics:  Hippocratic  Oath,”  Johns  Hopkins  University,  accessed  July 
13,  2016,  http://guides. library. jhu.edu/c.php?g=202502&p=l 335752. 

77  Benitez,  “Confidentiality  and  Its  Exceptions  (Including  the  U.S.  Patriot  Act),”  1. 

78  Ibid. 

79  Ibid. 
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According  to  one  expert,  “Without  assurances  of  confidentiality,  patients  will  be 
reluctant  to  divulge  sensitive  information  about  their  physical  and  mental  health, 
behavior,  and  lifestyle  that  would  be  vital  to  the  individual’s  treatment.”80  During 
testimony  before  the  Congressional  Subcommittee  on  Investigations  and  Oversight, 
House  Committee  on  Energy  and  Commerce,  Professor  Mark  Rothstein  of  the  University 
Of  Louisville  School  Of  Medicine  spoke  of  the  importance  of  confidentiality  of  medical 
records  by  stating: 

The  Privacy  Rule  codifies  this  crucial  requirement  for  ethical  and  effective 
health  care.  Surveys  of  patients  indicate  that  many  of  them,  fearful  of 
disclosure  of  their  sensitive  health  information,  currently  engage  in 
“defensive  practices”  by  withholding  certain  information  from  their  health 
care  providers.  Any  weakening  of  privacy  protections  would  undoubtedly 
increase  the  use  of  defensive  practices.81 

In  his  testimony,  Rothstein  cited  a  survey  conducted  by  the  California  Healthcare 
Foundation  in  which  two  thirds  of  the  public  surveyed  expressed  concern  over  the 
privacy  and  security  of  their  health  information.82 

To  ensure  the  protection  of  sensitive  and  private  health  infonnation,  the  federal 
government  and  states  have  passed  legislation  defining  the  legalities.  The  laws  define  the 
circumstances  in  which  a  practitioner  may  or  must  disclose  confidential  information.  This 
chapter  analyzes  the  laws,  explains  the  circumstances,  and  applies  the  laws  to  mental 
health  practitioners  working  in  the  realm  of  CVE. 

Federal  laws  tend  to  be  broad  and  far-reaching  forms  of  legislation  that  in  many 
cases  define  what  is  allowable  at  the  state  and  local  levels  of  government.  Many  federal 
regulatory  laws  may  be  viewed  as  defining  the  “bare  minimum,”  which  then  opens  the 
door  for  state  law  to  impose  stricter  requirements.  As  a  result,  state  laws  are  frequently 


80  Mark  A.  Rothstein,  Testimony  of  Mark  A.  Rothstein  Subcommittee  on  Investigations  and  Oversight, 
House  Committee  on  Energy  and  Commerce  (Washington,  DC:  U.S.  Congress,  2013),  1-2,  http://docs. 
house.gov/meetings/IF/IF02/20 130426/1 00769/HHRG- 1 1 3-IF02-Wstate-RothsteinM-20 1 30426.pdf. 

81  Ibid. 

82  “Consumers  and  Health  Information  Technology:  A  National  Survey,”  April  2010,  2,  http://www. 
chcf.org/~/media/MEDIA%20LIBRARY%20Files/PDF/PDF%20C/PDF%20ConsumersHealthInfoTechnol 
ogyNationalSurvey.pdf. 
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more  restrictive  than  federal  laws  covering  the  same  topic.83  The  negative  consequence 
of  the  existence  of  different  laws  affecting  the  same  topic,  but  created  by  different  levels 
of  government,  is  the  legal  confusion  they  may  create.  While  this  combination  of  laws 
affords  some  practitioners  and  patients  a  great  deal  of  confidentiality  protection,  it  also 
makes  for  confusion,  as  standards  and  strictures  change  from  jurisdiction  to  jurisdiction. 
When  referring  to  confidentiality  law,  most  practitioners  refer  to  HIPAA.  Rarely  are  state 
laws  spoken  of  or  cited.  When  state  laws  afford  exceptions,  they  must  also  align  with  the 
federal  law.  For  example,  Maryland  law  allows  for  the  sharing  of  confidential  medical 
information  with  any  state  sanctioned  representative  conducting  their  official  business. 
This  exception  must  then  also  align  with  the  Privacy  Act  exceptions.84 

1.  HIPAA  Background 

The  Health  Insurance  Portability  and  Accountability  Act,  commonly  known  as 
HIPAA,  is  the  federal  law  of  the  land  regulating  health  care  infonnation.  As  a  result, 
HIPAA,  and  the  accompanying  Privacy  Rule,  represent  the  bare  minimum  of  legal 
regulation  of  PHI.  Due  to  the  confusion  surrounding  the  implications  of  the  law,  HIPAA 
has  been  described  as  the  elephant  in  the  room  that  may  need  to  be  euthanized  (or  at  least 
better  defined  and  explained  to  the  public  and  practitioners).85  The  application  of  the 
federal  law  has  created  a  confusing  environment  in  which  health  care  providers  must 
learn  to  operate.  The  impact  of  the  law  is  so  confusing  that  both  government  and  private 
companies  frequently  bring  in  outside  experts  to  conduct  training  for  employees.  Even 
with  specialized  training,  a  lot  of  confusion  remains  concerning  who  the  law  applies  to, 
and  what  the  law  requires  or  allows.  It  has  been  asserted  that  medical  entities  regulated 
by  federal  law  may  use  the  existence  of  the  law  as  an  excuse  not  to  make  lawful 


83  John  Petrila  and  Hallie  Fador-Towe,  Information  Sharing  in  Criminal  Justice — Mental  Health 
Collaborations:  Working  with  HIPAA  and  Other  Privacy  Laws  (Lexington,  KY:  CSG  Justice  Center, 

2010),  vii,  https://csgjusticecenter.org/wp-content/uploads/2012/12/Infonnation_Sharing_m_Criminal_ 
Justice-Mental_Health_Collaborations-2.pdf. 

84  State  of  Maryland,  22.  Medical  Records  Act--Duty  to  Hold  Confidential  and  Duty  to  Disclose  a 
Medical  Record,  Health-General  Article  §  §  4-301-4-309,  <S’-60/(Baltimorc,  MD:  Maryland  Department  of 
Mental  Health  and  Hygiene,  n.d.),  accessed  September  12,  2016,  http://dhmh.maryland.gov/psych/pdfs/ 
Medicalreports.pdf. 

85  Officer  Scott  Davis,  Crisis  Intervention  Team,  Montgomery  County  Police. 
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disclosures  of  medical  information  in  situations  that  may  warrant  the  disclosure.  The  lack 
of  disclosure  may  be  the  result  of  ignorance  of  what  laws  dictate,  allow,  or  mandate;  or 
the  laws  may  actually  be  used  as  an  excuse  not  to  disclose  if  the  disclosure  is  deemed 
inconvenient  or  burdensome.86 

As  with  all  legislation,  HIPAA  began  as  a  bill,  proposed  by  U.S.  Senators  Edward 
Kennedy  and  Nancy  Kassebaum  to  address  privacy  and  confidentiality  with  health  care 
information.  Prior  to  the  proposal  of  the  bill,  no  federal  law  regulated  the  confidentiality 
of  PHI.87  The  bill  was  passed  by  Congress  and  signed  by  President  Bill  Clinton  on 
August  21,  1996.  The  new  federal  law  (HIPAA)  was  also  known  as  Pub.  L.  No.  1 04- 
191. 88  Even  though  the  original  intent  of  the  bill,  and  subsequent  law,  was  to  regulate  the 
electronic  transfer  of  private  medical  information,  and  to  mandate  privacy  regulations  on 
certain  covered  entities,  HIPAA  and  the  Privacy  Rule  have  “become  the  de  facto  legal 
standard  for  health  privacy  issues  involving  both  covered  and  un-covered  entities  in  the 
United  States.”89 

Title  45  of  the  Code  of  Federal  Regulations  (CFR)  provides  the  regulations  and 
rules  that  apply  to  the  Department  of  Health  and  Human  Services  (DHHS).  Section  160. 
103  provides  the  federal  definition  of  health  care  as: 

care,  the  services  and  supplies  related  to  an  individual’s  health,  are  all 
considered  health  care.  Preventative,  diagnostic,  rehabilitative, 
maintenance,  or  palliative  care,  counseling  service,  assessment,  or 
procedure  with  respect  to  the  physical  or  mental  condition  or  functional 


86  Rothstein,  Testimony  of  Mark  A.  Rothstein  Subcommittee  on  Investigations  and  Oversight,  House 
Committee  on  Energy  and  Commerce,  4. 

87  Daniel  J.  Solove,  “HIPAA  Turns  10:  Analyzing  the  Past,  Present  and  Future  Impact,”  Journal  of 
AHIMA  84,  no.  4  (April  2013):  22-28. 

88  Rebecca  Herold  and  Kevin  Beaver,  The  Practical  Guide  to  HIPAA  Privacy  and  Security 
Compliance,  2nd  ed.  (United  Kingdom:  Taylor  &  Francis  Group,  LLC,  2015),  1. 

89  Mark  A.  Rothstein,  “Tarasoff  Duties  after  Newtown,”  Journal  of  Law,  Medicine  &  Ethics  42 
(2014):  107. 
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status  of  an  individual  or  that  affects  the  structure  or  function  of  the 

body.90 

HIPAA  defines  regulated  health  information  as,  “[i] individually  identifiable 
health  information  transmitted  by  electronic  media,  maintained  in  electronic  media, 
transmitted  or  maintained  in  any  other  form  or  medium.”91  HIPAA  uses  this  definition  to 
identify  what  is  referred  to  as  PHI  under  the  law.  PHI  may  also  be  described  as  any 
information  related  to  health  care  that  may  individually  identify  the  patient,  such  as  any 
data  that  relates  to  an  individual’s  past,  present,  or  future  physical  or  mental  health, 
payment,  or  provision  of  care  to  the  individual  92  PHI  covered  by  HIPAA  includes: 

•  Patient  names 

•  Geographic  areas  smaller  than  a  state  to  include  street  addresses,  city  or 
town,  county,  precinct,  or  zip  code 

•  Numerical  identifiers,  such  as  telephone  numbers,  social  security  numbers, 
medical  record  numbers,  health  plan  beneficiary  numbers,  account 
numbers,  certificate/license  numbers,  device  identifiers  and  serial 
numbers,  and  elements  of  dates  related  to  birth,  death,  admission  or 
discharge,  except  for  the  year 

•  Email  addresses 

•  Vehicle  identifiers 

•  Computer  identifiers,  such  as  uniform  resource  locators  and  internet 

provider  addresses 

•  Images  and  photographs 

•  Biometric  identifiers,  such  as  DNA,  fingerprints,  and  voice  prints 

•  Any  other  identifying  factor  unique  to  the  patient93 


90  Cornell  University  Law,  LII/Legal  Information  Institute,  “45  CFR  160.103 — Definitions,”  accessed 

July  23,  2016,  https://www.law.cornell.edu/cfr/text/45/160. 103;  U.S.  Government,  45  CFR  Part  160 — 
Subchapter  C — Administrative  Data  Standards  and  Related  Requirements  (Washington,  DC:  Government 
Printing  Office,  n.d.),  698,  accessed  August  6,  2016,  https://www.gpo.gov/fdsys/pkg/CFR-2007-title45- 
voll/pdf/CFR-2007-title45-vol  l-partl60.pdf.  . ‘ 

91  Herold  and  Beaver,  The  Practical  Guide  to  HIPAA  Privacy  and  Security  Compliance,  16. 

93  “Summary  of  the  HIPAA  Privacy  Rule,”  May  7,  2008,  http://www.hhs.gov/hipaa/for-professionals/ 
privacy/laws-regulations/index.html. 

93  Herold  and  Beaver,  The  Practical  Guide  to  HIPAA  Privacy  and  Security  Compliance,  16. 
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HIPAA  delegated  the  DHHS  as  the  arm  of  the  federal  government  responsible  for 
implementing  and  enforcing  HIPAA  and  the  standards  inherent  in  the  law.94  The  original 
language  of  the  law,  located  in  Sections  261-264,  assigned  responsibility  to  the  Secretary 
of  DHHS  to  make  public  the  standards  and  practices  for  the  exchange  and  protection  of 
PHI. 


Furthermore,  the  law  required  that  the  Secretary  of  DHHS  issue  the  regulations 
mandating  the  accomplishment  of  the  law  if  Congress  failed  to  do  so  within  three  years 
after  the  law  was  passed.  DHHS  released  a  proposed  set  of  standards  to  the  public  for 
comment  in  November  1999.  In  2002,  DHHS  released  the  Standards  for  Privacy  of 
Individual  Identifiable  Health  Information,  which  is  commonly  referred  to  as  the  Privacy 
Rule.95  DHHS  also  assigned  oversight  and  enforcement  responsibilities  to  its  Office  for 
Civil  Rights  (OCR).96 

2.  The  Privacy  Rule 

The  Privacy  Rule  creates  the  national  standards  for  the  protection  of  PHI.  The 
main  goal  of  the  Privacy  Rule  is  to  balance  the  confidentiality  of  an  individual’s  PHI  with 
society’s  needs.  When  crafting  the  Privacy  Rule,  DHHS  recognized  that  the  disclosure  or 
sharing  of  otherwise  protected  PHI  was  sometimes  necessary  to  accomplish  public  health 
goals  and  other  community  needs. 

Public  health  practice  often  requires  the  acquisition,  use,  and  exchange  of 
PHI  to  perform  public  health  activities  (e.g.,  public  health  surveillance, 
program  evaluation,  terrorism  preparedness,  outbreak  investigations, 
direct  health  services,  and  public  health  research).  Such  information 
enables  public  health  authorities  to  implement  mandated  activities  (e.g., 
identifying,  monitoring,  and  responding  to  death,  disease,  and  disability 
among  populations)  and  accomplish  health  objectives.97 


94  Herold  and  Beaver,  The  Practical  Guide  to  HIPAA  Privacy  and  Security  Compliance,  6. 

95  “Summary  of  the  HIPAA  Privacy  Rule.” 

96  Ibid. 

97  “HIPAA  Privacy  Rule  and  Public  Health,  Guidance  from  CDC  and  the  U.S.  Department  of  Health 
and  Human  Services*,”  April  11,  2003,  http://www.cdc.gov/mmwr/preview/mmwrhtml/m2e41  lal.htm. 
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The  Privacy  Rule  applies  its  regulations  to  organizations  it  refers  to  as  covered 
entities,  “health  plans,  health  care  clearing  houses,  and  any  health  care  provider  who 
transmits  any  health  care  information  electronically.”98  Due  to  the  sometimes  ambiguous 
nature  of  laws  and  the  manner  in  which  they  are  written,  whether  an  agency,  or  an 
individual,  qualifies  as  a  covered  entity  remains  vague.  Many  practitioners  have  taken  the 
stance  that  they  are  covered  entities  and  conduct  their  business  within  the  guidelines  of 
the  Privacy  Rule.  According  to  a  report  sponsored  by  the  federal  Bureau  of  Justice 
Assistance  titled,  Information  Sharing  in  Criminal  Justice-Mental  Health  Collaborations: 
Working  with  HIPAA  and  Other  Privacy  Laws,  “HIPAA’s  restrictions  on  sharing  health 
information  are  often  misunderstood,  which  has  resulted  in  practitioners’  misapplying  the 
law  to  be  far  more  restrictive  than  the  actual  regulatory  language  requires.”99 

In  general,  the  Privacy  Rule  provides  for  the  following  areas: 

•  Gives  patients  increased  control  over  their  own  health  information 

•  Describes  the  confines  related  to  the  use,  maintenance,  and  disclosure  of 

health  records 

•  Sets  protective  measures  that  most  health-care  providers  must  follow  to 
protect  the  confidentiality  of  PHI 

•  Enforces  violations  of  the  Privacy  Rule  with  civil  and  criminal  penalties 
which  are  enforced  by  the  DHHSOCR 

•  Balances  individual  privacy  with  the  good  of  the  public 

•  Allows  patients  to  make  decisions  on  how  their  own  PHI  may  be  used 

•  Allows  patients  the  opportunity  to  learn  if  a  covered  entity  has  disclosed 
their  PHI 

•  Limits  PHI  disclosure  to  the  amount  minimally  reasonable  to  accomplish 
the  purpose  of  the  disclosure 

•  In  most  cases,  allows  the  patient  the  right  to  have  copies  of  their  own 
medical  records  and  the  ability  to  request  corrections 


98  “Summary  of  the  HIPAA  Privacy  Rule.” 

99  Petrila  and  Fador-Towe,  Information  Sharing  in  Criminal  Justice — Mental  Health  Collaborations: 
Working  with  HIPAA  and  Other  Privacy  Laws,  viii. 
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•  Allows  individuals  to  control  the  use  and  disclosure  of  their  PHI100 

When  deciphering  the  meaning  inherent  in  the  Privacy  Rule,  one  of  the  first  steps 
involves  determining  who  is  a  covered  entity,  or  who  is  regulated  by  the  Rule.  At  first 
look,  it  seems  that  the  entities  covered  are  any  health  plan,  health  care  clearing  house,  or 
any  health  care  provider  who  transmits  PHI  electronically.101  As  noted  previously,  both 
behavioral  and  physical  health  care  providers  are  covered  entities.  The  law  does  not 
differentiate  between  organizations  that  provide  general  care  and  specialty  health  care 
providers  or  facilities.  Correctional  facility  health  care  is  covered.102 

As  important  as  determining  who  or  what  may  be  covered  is  determining  who  or 
what  is  not  covered.  LE  agencies  and  officers  are  not  covered  entities.  “The  HIPAA 
Privacy  Rule  broadly  defines  law  enforcement  as  ‘any  government  official  at  any  level  of 
government  authorized  to  either  investigate  or  prosecute  a  violation  of  the  law.”103  As  a 
result,  LE  is  not  bound  by  the  regulations  when  asked  to  provide  PHI  to  others,  unless  the 
LE  officer  originally  gained  the  information  from  another  entity  covered  by  the 
regulations.104  For  example,  if  a  LE  official  obtains  PHI  as  the  result  of  an  exception,  the 
PHI  may  not  be  further  shared  unless  the  subsequent  recipient  also  falls  under  an 
exception.  Courts  and  judicial  systems  are  also  not  covered  by  HIPAA  or  the  Privacy 
Rule  due  to  the  responsibility  they  hold  in  sentencing  or  monitoring  the  treatment  of 
persons  in  the  system.  This  exclusion  also  takes  into  account  the  court’s  role  in 
overseeing  treatment  and  compliance  with  its  rulings.105  “Correctional  institutions  are  not 
considered  ‘covered  entities’  under  HIPAA  unless  they  classify  themselves  as  such.”106 


100  “HIPAA  Privacy  Rule  and  Public  Health,  Guidance  from  CDC  and  the  U.S.  Department  of  Health 
and  Human  Services*.” 

101  Herold  and  Beaver,  The  Practical  Guide  to  HIPAA  Privacy  and  Security  Compliance,  12. 

102  Petrila  and  Fador-Towe,  Information  Sharing  in  Criminal  Justice — Mental  Health  Collaborations: 
Working  with  HIPAA  and  Other  Privacy  Laws,  1 1 . 

103  “Law  Enforcement  Access,”  accessed  August  15,  2016,  https://www.eff.org/issues/law- 
enforcement-access. 

104  Petrila  and  Fador-Towe,  Information  Sharing  in  Criminal  Justice — Mental  Health  Collaborations: 
Working  with  HIPAA  and  Other  Privacy  Laws,  5. 

105  Ibid.,  8-10. 

106  Ibid.,  11. 
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These  instances  may  be  an  example  of  the  institution  applying  the  boundaries  of  the  law 
in  an  over-reaching  manner  due  to  a  lack  of  understanding  of  the  law,  or  because  it  is 
easier  to  be  classified  as  a  covered  entity  and  then  not  have  to  face  civil  liability  for 
releasing  PHI  even  if  the  disclosure  is  allowable  under  the  language  of  the  law. 

The  Privacy  Rule  also  identifies  what  it  describes  as  hybrid  entities;  covered 
entities  that  perform  functions  that  are  both  covered  and  not  covered.107  A  hybrid  entity 
may  separate  its  functions  so  that  the  Privacy  Rule  only  applies  to  those  functions  that 
align  with  covered  entities.  The  remaining  functions  would  not  fall  under  the  regulation 
of  the  Rule.108  The  onus  for  determining  which  components  are  covered  falls  upon  the 
entity.  The  portions  of  the  hybrid  entity  must  then  function  as  standalone  covered  entities 
and  must  treat  the  non-covered  components  as  it  would  outside  business  associates  in 
terms  of  abiding  to  the  Privacy  Rule.109 

The  Privacy  Rule  mandates  some  affirmative  duties  on  covered  entities.  These 
duties  represent  standards  that  must  be  adopted  by  any  covered  entity.  The  Privacy  Rule 
requires  that  covered  entities:110 

•  Notify  individuals  of  their  privacy  rights  as  afforded  by  the  Privacy  Act, 
and  of  how  any  of  their  PHI  may  be  used  or  disclosed 

•  Create  and  implement  internal  policies  and  procedures  for  the  safekeeping 
of  PHI  (including  physical  security  procedures) 

•  Train  employees  on  the  policies  and  procedures 

•  Assign  employees  to  manage  the  enactment  of  privacy  policies  and  who 
will  handle  related  complaints 

•  Include  appropriate  privacy  regulations  in  contracts  with  business  partners 

•  Entities  must  accommodate  clients’  rights 

107  U.S.  Government,  45  CFR  Part  164  Subpart  A — General  Provisions  (Washington,  DC: 
Government  Printing  Office,  n.d.),  accessed  August  6,  2016,  https://www.gpo.gov/fdsys/pkg/CFR-2007- 
title45-voll/pdf/CFR-2007-title45-vol  l-partl64-subpartA.pdf. 

108  “F1IPAA  Privacy  Rule  and  Public  Flealth,  Guidance  from  CDC  and  the  U.S.  Department  of  Health 
and  Human  Services*.” 

109  U.S.  Government,  45  CFR  Part  164  Subpart  A — General  Provisions,  733. 

110  “HIPAA  Privacy  Rule  and  Public  Health,  Guidance  from  CDC  and  the  U.S.  Department  of  Health 
and  Human  Services*.” 
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The  Privacy  Rule  defines  the  term  disclosure  as,  “the  release,  transfer,  provision 
of,  access  to  or  divulging  in  any  other  manner  of  information  outside  the  entity  holding 
the  information.”111  The  Privacy  Rule  mandates  the  disclosure  of  PHI  in  only  two 
circumstances,  to  the  individual  owner  of  the  PHI  (patient),  and  when  required  by  the 
Secretary  of  DHHS  when  the  agency  needs  to  determine  if  a  covered  entity  is  complying 
with  the  regulations  set  forth  in  the  Rule.112 

The  Privacy  Rule  also  delineates  when  it  is  may  be  pennissible  for  a  covered 
entity  to  disclose  PHI.  It  is  important  to  note  that  these  exceptions  are  not  required,  but 
that  the  Rule  allows  for  the  disclosures  under  certain  situations.  The  most  obvious  and 
broad  exception  is  the  use  of  consent  by  the  owner  of  the  PHI  to  disclose  or  use  the 
information.  When  the  use  of  the  PHI  is  not  for  the  purposes  of  treatment,  billing,  or 
otherwise  permitted  by  the  Privacy  Rule,  a  covered  entity  must  obtain  written  permission 
from  the  individuals  to  disclose  their  PHI.113  This  option  may  apply  in  cases  where  the 
individual  is  referred  to  the  covered  entity  by  a  court,  such  as  community  supervision  or 
when  the  court  allows  a  supervising  agent,  such  as  a  parole  or  probation  agent,  the  ability 
to  obtain  medical  records  to  ensure  compliance  with  a  court  mandate  for  the  individual. 
Courts  may  make  a  condition  of  an  individual’s  release  from  custody  or  a  treatment  order 
that  the  individual  grant  consent  for  providers  to  release  the  individual’s  PHI  to  ensure 
compliance.114 

It  is  also  acceptable  for  covered  entities  to  disclose  de-identified  PHI.  The  Rule 
does  not  place  any  restrictions  on  the  use  of,  or  disclosure  of  de-identified  PHI.  The  Rule 
clearly  defines  de-identified  PHI  as  “aggregate  statistical  data  or  data  stripped  of 


111  U.S.  Government,  45  CFR  Part  160 — Subchapter  C — Administrative  Data  Standards  and  Related 
Requirements,  697 . 

112  U.S.  Government,  45  CFR  Part  164  Subpart  E — Privacy  of  Individually  Identifiable  Health 
Information  (Washington,  DC:  Government  Printing  Office,  n.d.),  746,  accessed  August  6,  2016,  https:// 
www.gpo.gov/fdsys/pkg/CFR-2007-title45-voll/pdf/CFR-2007-title45-vol  l-partl64-subpartE.pdf. 

113  “Summary  of  the  F1IPAA  Privacy  Rule.” 

114  Petrila  and  Fador-Towe,  Information  Sharing  in  Criminal  Justice — Mental  Health  Collaborations: 
Working  with  HIPAA  and  Other  Privacy  Laws,  8. 
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individual  identifiers.”115  Title  45  CFR  Part  164  Subpart  E  §164.  514  defines  the  process 
for  creating  de-identified  PHI  and  provides  a  list  of  identifiers  that  must  be  removed  from 
PHI  to  qualify  as  de-identified.116  The  process  of  de-identifying  PHI  to  remove  the 
protections  on  the  information  provided  by  the  Privacy  Rule  may  be  referred  to  as  a  “Safe 
Harbor”  method.  The  process  requires  the  removal  of  18  identifiers  from  the  PHI.  The 
identifiers  include  information,  such  as  names,  numerical  identifiers,  images,  and 
biometric  information.117  The  remaining  information  must  not  be  capable  of  being  used 
to  identify  the  subject.118 

Federal  Title  45  CFR  Part  164  Subpart  E  §164.  512  is  titled  “Uses  and  disclosures 
for  which  an  authorization  or  opportunity  to  agree  or  object  is  not  required.”119  As  the 
title  indicates,  this  section  of  the  Privacy  rule  allows  for  the  disclosure  of  PHI  without  the 
owner’s  consent.120  The  Rule  allows  for  the  disclosure  of  PHI  under  certain  conditions, 
but  the  Rule  does  not  mandate  or  require  the  disclosure.  The  disclosure  may,  however,  be 
mandatory  under  other  law,  such  as  state  laws  (see  exception  [a]  or  [c]).  The  exceptions 
listed  in  the  section  include:121 

a)  Uses  and  disclosures  required  by  law 

b)  Standard  uses  and  disclosures  for  public  health  activities 

c)  Disclosures  concerning  the  victims  of  abuse,  neglect,  or  domestic  violence 

d)  Disclosures  for  health  oversight  activities 

e)  Disclosures  for  judicial  and  administrative  proceedings 

f)  Disclosures  for  law  enforcement  purposes 

g)  Uses  and  disclosures  in  relation  to  medical  examiners  and  coroners 

115  “HIPAA  Privacy  Rule  and  Public  Health,  Guidance  from  CDC  and  the  U.S.  Department  of  Health 
and  Human  Services*.” 

1 16  U.S.  Government,  45  CFR  Part  164  Subpart  E — Privacy  of  Individually  Identifiable  Health 
Information,  766-770. 

117  “HIPAA  Privacy  Rule  and  Public  Health,  Guidance  from  CDC  and  the  U.S.  Department  of  Health 
and  Human  Services*.” 

118  Ibid. 

1 19  U.S.  Government,  45  CFR  Part  164  Subpart  E — Privacy  of  Individually  Identifiable  Health 
Information,  757-766. 

120  Ibid. 

121  Ibid. 
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h)  Cadaveric  organ,  eye,  or  tissue  donation 

i)  Research  purposes 

j)  Disclosures  to  avert  serious  threats  to  health  and  safety 

k)  Specialized  government  functions 

The  aforementioned  letters  also  correspond  with  the  paragraph  sections  in  the  Rule.  This 
section  focuses  on  paragraphs  (j)  and  (k). 

§164.  512  paragraph  (j)  provides  perhaps  some  of  the  most  applicable  guidance 
when  considering  the  Privacy  Rule  in  connection  with  the  relationship  between  mental 
health  practitioners  and  LE.  The  section  reads  as  follows: 

(j)  Standard:  Uses  and  disclosures  to  avert  a  serious  threat  to  health  or 
safety- 


(1)  Permitted  disclosures.  A  covered  entity  may,  consistent  with 
applicable  law  and  standards  to  ethical  conduct,  use  or  disclose 
protected  health  information,  if  the  covered  entity,  in  good  faith, 
believes  the  disclosure: 

(0 


(A)  Is  necessary  to  prevent  or  lessen  a  serious  and 
imminent  threat  to  the  health  and  safety  of  a  person  or  the 
public;  and 

(B)  Is  to  a  person  or  persons  reasonably  able  to  prevent  or 
lessen  the  threat,  including  the  target  of  the  threat;  or 

(ii)  Is  necessary  for  law  enforcement  authorities  to  identify  or 
apprehend  an  individual 

(A)  Because  of  a  statement  by  an  individual  admitting 
participation  in  a  violent  crime  that  the  covered  entity 
reasonably  believes  may  have  caused  serious  physical  harm 
to  the  victim.122 

The  section  goes  on  to  state  that  the  use  and  disclosure  of  the  PHI  referenced  in  (j) 
(1)  (ii)  (A)  is  not  permitted  if  the  information  is  discovered  by  the  covered  entity  during 
treatment  in  which  the  covered  entity  is  detennining  the  likelihood  for  the  individual  to 


122  U.S.  Government,  45  CFR  Part  164  Subpart  E — Privacy  of  Individually  Identifiable  Health 
Information,  764. 
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commit  the  crime,  or  during  counseling  or  therapy,  or  if  the  infonnation  is  in  relation  to 
the  reason  for  which  the  individual  sought  the  treatment.  In  other  words,  if  the  covered 
entity  is  a  therapist  and  is  attempting  to  detennine  the  likelihood  of  their  patient 
committing  a  crime,  the  situation  would  not  satisfy  the  exception.  The  section  would  also 
not  be  applicable  if  the  propensity  for  the  individual  to  commit  the  crime  was  the  reason 
that  the  individual  sought  treatment. 

More  broadly,  paragraph  (k),  which  addresses  specialized  government  functions, 
focuses  specifically  on  a  national  security  exception  to  the  Privacy  Rule.  Section  (2)  of 
the  paragraph  reads: 

National  security  and  intelligence  activities.  A  covered  entity  may  disclose 
protected  health  infonnation  to  authorized  federal  officials  for  the  conduct 
of  lawful  intelligence,  counter-intelligence,  and  other  national  security 
activities  authorized  by  the  National  Security  Act  (50  U.S.  C.  401,  et  seq.  ) 
and  implementing  authority  (e.  g.  Executive  Order  12333). 123 

Once  again,  it  is  important  to  note  that  even  these  “national  security  disclosures 
are  permissive  rather  than  mandatory  under  HIPAA  (your  doctor  can  say  no),  but  the 
language — particularly  the  disclosures  to  agencies — is  amazingly  broad.”124 

B.  MARYLAND  HEALTH  CARE  LAWS 

Since  each  state  has  its  own  companion  laws  to  the  federal  medical  privacy  law, 
this  thesis  uses  Maryland’s  health  care  laws  as  the  example  of  state  law.  Maryland’s 
health  care  laws  are  similar  to  HIPAA  and  the  Privacy  Rule.  For  example,  Maryland’s 
law  allows  for  the  disclosure  of  PHI  under  certain  circumstances,  which  are  similar  to  the 
Privacy  Rule  exceptions.  Like  the  federal  exceptions,  the  disclosures  under  these 
circumstances  are  permissible  and  not  mandatory. 

Maryland  law  relating  to  health  records  may  be  found  in  the  State  Code  Article 
titled  Health-General  under  sections  §4-301  through  §4-309.  Section  §4-301  provides 
definitions,  including  that  the  statute  applies  to  both  physical  and  mental  health  care 

123  U.S.  Government,  45  CFR  Part  164  Subpart  E — Privacy  of  Individually  Identifiable  Health 
Information,  765. 

124  “National  Security  and  Medical  Information.” 
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providers.  The  statue  also  defines  health  care  providers  as  anyone  licensed,  certified,  or 
authorized  by  the  state  to  perforin  their  duties.  The  section  also  defines  medical  records 
to  include  “any  oral,  written,  or  other  transmission  in  any  form  or  medium  of 
information”  that  may  be  entered  into  a  patient’s  file,  identifies  the  patient,  and  relates  to 
the  care  of  the  patient.125 

Section  §4-302  has  to  do  with  confidentiality  and  the  general  disclosure  of 
medical  records.  The  section  mandates  that  health  care  providers  maintain  the 
confidentiality  of  medical  records  and  sets  the  authority  for  the  release  of  the  records  in 
accordance  with  the  section  or  by  other  law. 

Section  §4-303  allows  for  the  disclosure  of  medical  records  upon  the  request  of 
the  owner  of  the  records  (patient).  The  section  outlines  the  consensual  process  and 
requires  certain  information  regarding  the  authority  to  be  in  writing.  The  written  authority 
is  to  include  the  period  of  time  for  which  the  authorization  to  release  the  records  is  valid 
(not  to  exceed  one  year).  The  one  exception  to  the  time  limit  is  for  cases  in  which  the 
patient  was  referred  for  treatment  by  a  criminal  justice  entity,  such  as  a  court.  In  these 
cases,  the  length  of  release  authority  extends  until  30  days  following  the  final  disposition 
of  the  case.126  The  section  of  the  Code  titled  “Disclosures  without  authorization  of  person 
in  interest”  (§4-305)  is  a  state  law  similar  in  structure  to  the  exceptions  provided  in  the 
federal  Privacy  Rule.  This  section  also  allows  for  disclosures,  which  are  permissive,  and 
not  mandatory.  The  first  line  of  the  section  reads,  “This  section  may  not  be  construed  to 
impose  an  obligation  on  a  health  care  provider  to  disclose  a  medical  record.”127  Sub¬ 
section  3  allows  for  the  disclosure  of  medical  records  “to  a  government  agency 
performing  its  lawful  duties  as  authorized  by  an  act  of  the  Maryland  General  Assembly  or 
the  United  States  Congress.”128  The  sub-section  notes  that  further  restrictions  will  follow 
in  a  subsequent  sub-section  related  to  the  disclosure  of  mental  health  records.  The 


125  State  of  Maryland,  22.  Medical  Records  Act--Duty  to  Hold  Confidential  and  Duty  to  Disclose  a 
Medical  Record,  Health-General  Article  §  §  4-301—4-309,  8-601. 

126  Ibid. 

127  Ibid. 

128  Ibid. 
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section,  otherwise,  permits  the  release  of  medical  records  by  a  provider  to  other 
government  agencies  in  Maryland  or  federal  government  agencies  by  the  provider 
without  the  authorization  of  the  patient.  Sub-section  6  goes  on  to  authorize  (pennissive 
and  not  mandatory)  the  release  of  medical  records  if  the  provider  “makes  a  professional 
determination  that  immediate  disclosure  is  necessary  to  provide  for  the  emergency  health 
care  needs  of  a  patient.”  What  is  of  note  concerning  this  area  of  the  law  is  that  it  provides 
no  interpretation  of  circumstances,  and  leaves  the  decision  up  to  the  provider.129 

Section  §4-306,  titled  “Disclosures  without  authorization  of  person  of  interest — 
Investigations,”  is  similar  to  the  Privacy  Rule’s  45  CFR  Part  164  Subpart  E  §164.  512 
paragraph  (f)  in  that  it  addresses  compulsory  disclosures  in  response  to  legal  processes  to 
include  action  needed  to  satisfy  a  subpoena,  search  warrant,  or  court  order.  These 
occasions  involve  a  mandatory  release  of  otherwise  protected  information  in  response  to 
a  legal  order. 

The  second  part  of  §4-306  involves  permitted  disclosures  without  the  consent  or 
authorization  of  the  patient.  Sub-section  (b)  (1)  reads  as  follows: 

(b)  Permitted  Disclosures,  —A  health  care  provider  shall  disclose  a 

medical  record  without  the  authorization  of  a  person  of  interest: 

(1)  To  a  State  or  local  government,  or  to  a  member  of  a 
multidisciplinary  team  assisting  the  unit,  for  the  purposes  of 
investigation  or  treatment  in  a  case  of  suspected  abuse  or  neglect  of  a 
child  or  adult,  subject  to  the  following  conditions: 

(i)  The  health  care  provider  shall  disclose  only  the  medical  record 
of  a  person  who  is  being  assessed  in  an  investigation  or  to  whom 
services  are  being  provided  in  with  Title  5,  Subtitle  7,  or  Title  14, 

Subtitle  3  of  the  Family  Law  Article; 

(ii)  The  health  care  provider  shall  disclose  only  the  infonnation  in 
the  medical  record  that  will,  in  the  professional  judgment  of  the 
provider,  contribute  to  the: 

1 .  Assessment  of  risk; 


129  Maureen  O’Brien,  “HIPAA  vs.  Probable  Cause — Bridging  the  Communication  Gap”  (PowerPoint, 
Practitioner  Legal  Training,  Montgomery  County,  Maryland,  June  23,  2016). 
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2.  Development  of  a  service  plan; 

3.  Implementation  of  a  safety  plan;  or 

4.  Investigation  of  the  suspected  case  of  abuse  or  neglect;  and 

(iii)  the  medical  record  may  be  disclosed  as  provided  in  §§  1-201, 

1-202,  1-204,  and  1-205  of  the  Human  Services  Article.130 

Section  7  of  paragraph  (b)  permits  health  care  providers  to  release  protected  information 
to  grand  juries,  prosecution  agencies,  LE  agencies,  or  their  agents  in  furtherance  of  a 
prosecution  or  investigation.  The  section  of  the  law  does,  however,  require  that  the 
receiving  agency  has  written  procedures  in  place  designed  to  protect  and  safely  store  and 
use  the  information. 

Section  §4-307  is  the  area  of  Maryland  law  that  discusses  the  release  of  mental 
health  records.  Maryland  duty  to  protect  laws  are  discussed  in  a  later  chapter  of  this 
thesis.  The  statute  separates  mental  health  medical  records  from  the  personal  notes  of  the 
provider.  Personal  notes  are  defined  as  “the  work  product  or  personal  property  of  a 
mental  health  provider.”131  Personal  notes  must  be  kept  separate  from  records,  and  may 
not  include  information  concerning  diagnosis  or  treatment. 

Paragraph  (j)  of  the  section  addresses  disclosures  in  relation  to  the  health,  safety, 
or  protection  of  others,  (j)  (1)  2.  (ii)  connects  directly  with  Maryland’s  duty  to  protect 
provision’s  Courts  and  Judicial  Proceedings  Article  Section  §5-609,  which  is  discussed  in 
the  duty  to  warn  chapter  of  this  thesis. 

Section  §4-308  absolves  a  health  care  provider  from  “any  cause  of  action”  for 
either  disclosing  or  not  disclosing  a  medical  record  if  that  action  was  taken  in  compliance 
with  the  law. 

C.  ANALYSIS  OF  MEDICAL  RECORDS  AND  CONFIDENTIALITY  LAWS 

AND  CVE 

Federal  and  state  medical  privacy  laws  protect  patient’s  PHI  from  disclosure. 
Patients  have  a  need  to  feel  that  their  private  information  is  safe.  Medical  practitioners 

130  State  of  Maryland,  22.  Medical  Records  Act--Duty  to  Hold  Confidential  and  Duty  to  Disclose  a 
Medical  Record,  Health-General  Article  §  §  4-301—4-309,  8-601. 

131  Ibid. 
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need  their  patients  to  disclose  full  details  of  their  patient’s  condition  to  diagnose 
accurately  and  create  treatment  plans.  As  evidenced  by  the  Hippocratic  Oath,  medical 
practitioners  operate  under  strict  ethical  and  legal  mandates  to  protect  their  patient’s  PHI 
from  outside  entities,  including  government.  However,  even  laws  designed  to  keep 
personal  information  private  have  exceptions  built  in  to  balance  the  individual’s  right  to 
privacy  with  the  welfare  of  the  public.  CVE  practitioners  involved  in  intervention 
programs  will  be  on  the  razor’s  edge  of  this  balance. 

As  CVE  intervention  and  diversion  programs  very  much  involve  a  mental  health 
and  medical  component,  which  is  balanced  with  the  public  safety  component,  a  clear 
understanding  of  applicable  laws  is  vital.  CVE  programs  must  balance  confidentiality 
with  the  protection  of  the  public. 

CVE  programs  include  partnerships  with  NGOs  and  public  agencies  with  multiple 
functions.  The  balance  of  applying  privacy  laws  in  an  environment  including  multiple 
agencies  with  varying  functions  presents  a  challenge.  CVE  programs  also  represent  what 
the  Privacy  Rule  refers  to  as  hybrid  entities.  As  such,  it  is  the  responsibility  of  the 
program  to  decide  which  portions  of  the  structure  are  bound  by  the  Privacy  Rule,  and 
separate  the  different  components  of  the  program  to  comply  with  the  law. 

In  terms  of  disclosure  of  PHI,  the  Privacy  Rule  only  mandates  two  circumstances 
of  an  affirmative  obligation  to  disclose  PHI.  One  instance  involves  open  access  of  PHI  to 
the  patients  themselves,  and  the  other  involves  releasing  PHI  to  DHHS  for  the  purpose  of 
auditing  compliance  with  the  law.  Federal  and  state  laws  require  that  CVE  intervention 
programs  properly  record  and  store  medical  information  related  to  their  clients.  Both  sets 
of  laws  dictate  the  requirements  of  record  retention  and  storage.  Clients  receiving 
services  from  CVE  programs  have  the  right  to  review  their  medical  records  under  the 
law.  CVE  programs  are  also  required  to  explain  the  law  to  their  clients.  Programs  must 
also  be  prepared  to  release  medical  records  to  DHHS  in  the  event  of  an  audit  to  ensure 
that  the  federal  law  is  being  followed. 

One  of  the  easiest  ways  to  disclose  PHI  is  with  the  patient’s  consent.  The  Privacy 
Rule  requires  written  permission  from  the  owner  of  the  PHI.  Some  CVE  programs  might 
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use  written  consent  when  a  client  enters  the  program  that  would  be  in  conjunction  with  an 
explanation  of  the  rights  afforded  to  the  patient  under  the  Privacy  Rule  and  applicable 
state  laws.  It  would  also  involve  information  on  how  the  patient  could  revoke  the  consent. 
In  cases  where  a  patient  is  referred  to  a  CVE  program  by  a  court  system,  consent  on  the 
part  of  the  patient  may  be  included  in  the  referral  if  the  court  orders  participation  in  the 
program. 

One  of  the  interesting  exceptions  to  confidentiality  in  the  Privacy  Rule  involves 
the  sharing  of  de-identified  PHI.  The  Privacy  Rule  provides  clear  instruction  on  what 
constitutes  de-identified  PHI.  According  to  the  Privacy  Rule,  there  are  no  restrictions  on 
the  use  of  de-identified  PHI.  The  Privacy  Rule  refers  to  the  use  of  de-identified  PHI  as 
the  “safe  harbor”  use.  It  is  possible  that  CVE  practitioners  may  use  de-identified  PHI  to 
discuss  otherwise  restricted  infonnation  concerning  clients  with  other  practitioners.  In 
such  cases,  where  other  options  are  not  available,  it  may  be  possible  for  mental  health 
practitioners  to  discuss  particular  details  concerning  a  client  if  all  information  that 
identifies  the  patient  is  removed  from  the  discussion.  Under  these  circumstances,  the 
practitioner  would  be  responsible  for  ensuring  that  the  discussion  did  not  include  any 
details  that  could  be  used  to  identify  the  patient. 

The  most  applicable  portion  of  the  Privacy  Rule  that  has  an  impact  on  the  ability 
of  CVE  practitioners  to  communicate  details  of  potentially  violent  clients  falls  under  the 
section  describing  the  pennissible  exceptions  to  the  Rule.  The  Rule  begins  explaining  the 
exceptions  by  stating  that  they  are  restricted  by  the  application  of  other  laws  or  ethical 
standards.  In  other  words,  the  exceptions  exist  when  not  restricted  by  other  laws.  The 
exceptions  are  required  to  balance  the  need  for  confidentiality  with  the  obligation  to 
protect  other  persons  or  the  public. 

Of  the  sections  describing  allowable  exceptions  to  confidentiality,  the  section 

discussing  government  functions  is  most  applicable  to  situations  likely  to  be  encountered 

in  a  CVE  environment.  The  Rule  allows  for  the  disclosure  of  PHI  without  the  patient’s 

consent  for  certain  government  functions,  including  intelligence  and  national  security 

functions.  When  other  avenues  permitting  disclosure  are  exhausted,  this  section  may 

allow  practitioners  to  disclose  infonnation  concerning  clients  who  pose  a  risk  to  others  by 
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violent  means.  Similar  to  other  laws  discussed,  this  section  of  the  Privacy  Act  is  broad 
and  leaves  much  open  to  discretion  and  interpretation;  however,  the  language  makes  it 
clear  that  the  federal  government’s  authority  to  conduct  intelligence  and  national  security 
investigations  is  an  exception  to  the  Rule.  It  is  important  to  remember  that  this  exception 
is  pennissive  and  not  mandatory,  but  the  language  of  the  Privacy  Act  leaves  open  the 
possibility  for  CVE  practitioners  to  disclose  PHI  to  the  federal  government  in  cases 
where  the  client  poses  a  risk  to  others  or  the  national  interest. 

Maryland  state  law  applying  to  the  confidentiality  of  medical  records  is  similar, 
and  in  many  ways,  mirrors  the  federal  law.  As  with  the  federal  law,  Maryland  state  law 
begins  by  defining  what  and  who  are  covered  by  the  law.  Based  on  Maryland’s  legal 
definitions,  CVE  practitioners  administering  mental  health  services,  including  therapists 
and  counselors,  would  be  covered  by  the  law.  Maryland’s  law  also  covers  the  use  of 
consent  by  the  patient  as  a  means  to  use  or  disseminate  medical  information. 

Likewise,  the  section  of  Maryland  law  addressing  disclosure  without  the 
authorization  of  the  “person  of  interest,”  is  similar  to  the  Privacy  Rule.  One  broad 
difference  is  that  Maryland  law  pennits  the  disclosure  of  medical  record  infonnation  to 
government  agencies  “performing  their  lawful  duties.”  As  with  other  aspects  of  both 
federal  and  state  law,  the  exception  is  permissible  and  not  mandatory  unless  required  by 
other  laws. 

Maryland  separates  mental  health  records  into  a  separate  section  of  the  law. 
Similar  to  the  minimally  reasonable  standard  of  the  Privacy  Rule,  Maryland  law 
mandates  that  mental  health  infonnation  released  must  only  be  relevant  to  the  purpose  of 
the  disclosure.  Maryland  health  confidentiality  law  refers  to  the  legal  section  covering 
mental  health  records  when  referring  to  disclosure. 

Based  on  both  federal  and  Maryland  state  law  on  the  use  and  disclosure  of  PHI,  it 
appears  that  the  laws  provide  broad  guidance  on  exceptions  allowing  for  disclosure.  In 
some  circumstances,  these  conditions  and  what  they  mean  may  present  confusing 
circumstances  for  practitioners. 
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III.  THE  DUTY  TO  WARN  AND  PROTECT 


Like  other  medical  health  professionals,  mental  health  professionals  have  an 
ethical  and  legal  obligation  to  protect  their  patient’s  confidentiality.  As  with  other  health 
disciplines,  this  obligation  is  designed  to  facilitate  a  trusting  relationship.  While  the 
protection  of  patient  privacy  is  critical,  and  mandated  by  law,  exceptions  are  built  into  the 
law.  Some  of  the  exceptions  are  pennissive  in  nature,  and  some  are  obligatory.  The 
exceptions,  especially  the  mandated  exceptions,  are  designed  to  balance  confidentiality 
with  the  prevention  of  danger  to  the  public.  A  legal  requirement  for  mental  health 
practitioners  to  warn  or  protect  a  third  party  from  the  actions  of  their  patient  is  one  such 
mandatory  exception  in  many  states. 

The  most  simple  definition  of  the  term  duty  to  warn  is  that  social  workers, 
therapists,  or  another  mental  health  workers  have  an  ethical  and  legal  obligation  to  warn  a 
third  party  of  a  potential  danger  presented  by  the  therapists’  client.132  The  term  duty  to 
protect  implies  that  the  therapists  have  a  larger  obligation  to  take  additional  steps  to 
protect  a  third  party  from  their  patients  when  they  have  reason  to  believe  that  the  patients 
pose  a  violent  threat  to  the  third  party.  “The  general  rational  on  which  such  laws  are 
predicated  holds  that  certain  individual  rights  must  give  way  to  the  greater  good  of 
society  or  to  the  rights  of  a  more  vulnerable  individual  (e.g.,  in  child  abuse  or  child 
custody  cases).”133  In  terms  of  a  state  licensed  therapist’s  duty  to  warn  or  protect,  the 
legislation  only  resides  at  the  state  level.  No  federal  law  mandates  a  duty  to  warn  or 
protect. 

In  his  article,  “Confidentiality  and  the  Duty  to  Warn:  Ethical  and  Legal 
Implications  for  the  Therapeutic  Relationship,”  James  Corbin  speaks  of  the  nature  of 
confidentiality  and  the  friction  it  may  cause  between  the  field  of  mental  health  and  other 


132  Granich,  “Duty  to  Warn,  Duty  to  Protect.” 

133  Gerald  Koocher  and  Patricia  Keith-Spiegel,  ‘“What  Should  I  Do?’  -  39  Ethical  Dilemmas 
Involving  Confidentiality  Educational,”  Continuing  Ed  Courses,  March  9,  2015,  11,  http://www. 
continuingedcourses.net/active/courses/course049.php. 
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disciplines,  such  as  elements  of  our  legal  system.134  Corbin  concedes  that  outsiders  may 
perceive  mental  health  as  an  unreliable  science  and  that  mental  health  practitioners  may 
view  laws  and  the  legal  system  as  foreign  and  contrary  to  the  aims  of  their  profession.135 
Corbin  describes  the  unavoidable  intersection  of  the  two  worlds.  As  a  result,  the 
importance  of  cross  training  and  knowledge  of  both  systems  is  important  to  practitioners 
in  both  fields.136 

Scholars  David  Wexler  and  Bruce  Winick  coined  the  term  “therapeutic  justice”  to 
describe  a  problem-solving  process  used  to  bring  the  two  fields  closer  together.137 

Therapeutic  jurisprudence  describes  the  problem-solving  process  between 
two  systems — a  study  on  the  impact  of  the  system  of  law  on  mental  health, 
as  well  as  the  impact  of  the  social  sciences  on  law.138 

The  mental  health  system  and  our  nation’s  criminal  justice  systems  (as 
well  as  civil  court  systems)  depend  on  the  expertise  and  knowledge  base 
from  each  respective  discipline,  as  well  as  the  prudence  of  those 
specialists  who  have  combined  expertise,  in  attempts  to  address  and  solve 
problems.  Both  fields  inform  the  practice  of  one  another.139 

The  theory  of  duty  to  warn  or  protect  is  one  issue  that  is  frequently  a  point  of  contention 
between  practitioners  of  mental  health  and  the  legal  system. 

Mental  health  practitioners  are  bound  by  the  same  legal  and  ethical  rules  as  other 
health  professionals.  The  American  Psychiatric  Association  published  “The  Principles  of 
Medical  Ethics  with  Annotations  Especially  Applicable  to  Psychiatry,”  which  outlines 
the  ethical  code  of  mental  health  professionals. 

Section  4  of  the  code  states,  “A  physician  shall  respect  the  rights  of  patients, 
colleagues,  and  other  health  professionals,  and  shall  safeguard  patient  confidences  and 


134  Corbin,  "‘Confidentiality  &  the  Duty  to  Warn:  Ethical  and  Legal  Implications  for  the  Therapeutic 
Relationship.” 

135  Ibid. 

136  Ibid. 

137  David  B.  Wexler,  “Two  Decades  of  Therapeutic  Jurisprudence,”  Touro  L.  Rev.  24  (2008):  17. 

138  Corbin,  “Confidentiality  &  the  Duty  to  Warn:  Ethical  and  Legal  Implications  for  the  Therapeutic 
Relationship.” 

139  Ibid. 
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privacy  within  the  constraints  of  the  law.”140  The  section  also  describes  how  mental 
health  records  must  be  protected  with  a  high  level  of  care  and  that  a  psychiatrist  may  only 
release  the  records  with  the  permission  of  the  patient  or  “under  proper  legal 
compulsion.”141  As  important  as  the  theory  of  confidentiality  is  to  health  care  as  a  whole, 
the  issue  is  magnified  in  the  realm  of  mental  health  care.  “The  confidential  relationship 
between  mental  health  professionals  and  their  clients  has  long  stood  as  the  cornerstone  of 
the  helping  relationship.”142 

The  need  for  confidentiality  in  psychotherapy  has  been  described  as  a 
“cornerstone”  upon  which  therapist  and  client  relationships  are  built.143  Confidentiality  is 
usually  described  as  the  restriction  placed  upon  the  disclosure  of  information  by  the 
mental  health  provider  outside  of  courtroom  settings,  where  the  practitioner’s  testimony 
is  demanded.  “Confidentiality  refers  to  a  general  standard  of  professional  conduct  that 
obliges  a  professional  not  to  discuss  information  about  a  client  with  anyone”144  As  with 
regular  health  care,  a  difference  exists  between  confidentiality  and  privilege  in  the  realm 
of  mental  health  care.  Privilege  refers  to  the  legal  immunity  that  certain  specific  types  of 
relationships,  such  as  therapist/client  relationships,  enjoy  from  testifying  in  court.145  As 
noted  in  the  chapter  on  HIPAA,  this  thesis  does  not  delve  into  the  concept  of  privilege, 
and  instead  focuses  on  the  issues  surrounding  the  theory  of  confidentiality. 

The  confidential  relationships  between  psychotherapists  and  their  clients  are 
considered  sacrosanct  for  very  good  reasons.  When  establishing  a  healing  or  helping 
relationship  with  a  therapist,  trust  in  an  essential  element.  If  potential  patients  believe  that 


140  American  Psychiatric  Association,  The  Principles  of  Medical  Ethics  with  Annotations  Especially 
Applicable  to  Psychiatry  (Arlington  County,  VA:  American  Psychiatric  Association,  2013),  2,  https://www. 
psychiatiy.org/File%20Library/Psychiatrists/Practice/Ethics/principles-medical-ethics.pdf;  “Confidentiality 
and  Privilege  in  Maryland,”  accessed  August  27,  2016,  http://mdpsych.org/resources/confidentiality-and- 
privilege-in-maryland/. 

141  Ibid.,  2;  Ibid.,  6-7. 

142  Koocher  and  Keith-Spiegel,  ‘“What  Should  I  Do?’  -  39  Ethical  Dilemmas  Involving 
Confidentiality  Educational,”  2. 

143  Benitez,  “Confidentiality  and  Its  Exceptions  (Including  the  US  Patriot  Act),”  32-36. 

144  Koocher  and  Keith-Spiegel,  ‘“What  Should  I  Do?’  -  39  Ethical  Dilemmas  Involving 
Confidentiality  Educational,”  8. 

145  Ibid.,  9. 
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professionals  will  disclose  the  personal  experiences  that  they  share  during  therapy,  many 
persons  needing  treatment  may  choose  not  to  seek  help.  The  successful  treatment  of 
ailments  requires  that  patients  fully  disclose  their  symptoms  for  the  provider  to  diagnose 
the  illness  successfully  and  construct  a  treatment  regimen.  An  argument  for  the  protection 
of  confidentiality  recognizes  that  patients  who  do  not  trust  the  confidential  nature  of  the 
relationship  they  have  with  their  therapist  may  not  fully  disclose  infonnation  needed  to 
diagnose  and  treat  their  conditions.146 

Since  duty-to-warn  or  -protect  statutes,  and  subsequent  interpretations  by  the 
judicial  branches,  exist  at  the  state  level,  the  laws  and  their  application  between  states 
vary  greatly.  As  shown  in  Figure  2,  the  states  may  be  divided  into  the  following  three 
categories:  states  that  mandate  a  duty  to  warn  or  protect,  states  that  have  permissive  laws 
that  allow  therapists  to  warn  or  protect  third  parties,  and  states  that  have  not  enacted 
legislation  concerning  any  duty  to  warn  or  protect.147  Each  of  these  three  categories 
presents  therapists  with  certain  obstacles  that  must  be  overcome  for  the  therapist  to  treat 
their  patients  successfully  and  follow  legal  guidance. 


146  Rothstein,  Testimony  of  Mark  A.  Rothstein  Subcommittee  on  Investigations  and  Oversight,  House 
Committee  on  Energy  and  Commerce,  1-2. 

147  Rebecca  Johnson,  Persad  Govind,  and  Dominic  Sisti,  “The  Tarasoff  Rule:  The  Implications  of 
Interstate  Variation  and  Gaps  in  Professional  Training,”  Journal  of  American  Academy  of  Psychiatry  and 
the  Law  Online  42,  no.  4  (December  1,  2014):  469-477,  http://www.jaapl.Org/content/42/4/469.long. 
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\rizona,  Delaware  and  Illinois  have  different  duties  for  different  professions. 


Figure  2.  State  Duty  to  Wam/Protect  Laws.148 


In  states  with  mandatory  statutes,  therapists  must  regulate  the  trusting  relationship 
with  their  patients  and  also  make  a  determination  on  whether  patient  disclosures  rise  to 
the  level  to  which  the  law  mandates  a  duty  to  warn  or  protect.  In  determining  whether  the 
therapists  must  discharge  the  duty  to  warn  or  protect,  the  therapists  must  evaluate  the 
level  of  risk  posed  by  their  client  and  decide  if  it  rises  to  the  level  required  by  that  state’s 
specific  guidance.  Different  states  also  make  other  requirements  affected  by  the 
imminence  of  the  potential  threat,  and  whether  the  indented  victim  is  known.149 

Therapists  who  work  in  states  with  permissive  statutes  face  even  more 
challenging  decisions. 

Therapists  in  states  with  permissive  statutes  have  several  legally 
acceptable  options  when  a  patient  makes  a  violent  threat  against  an 
identifiable  victim:  continue  therapy  as  planned  without  issuing  any 


1411  Source:  “Mental  Health  Professionals’  Duty  to  Warn,”  September  28,  2015,  http://www.ncsl.org/ 
research/health/mental-health-professionals-duty-to-warn.aspx. 

149  Johnson,  Govind,  and  Sisti,  “The  Tarasoff  Rule:  The  Implications  of  Interstate  Variation  and  Gaps 
in  Professional  Training,”  469-477. 
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warning,  change  the  therapy  to  contain  the  threat  and  protect  the  potential 
victim,  warn  law  enforcement,  warn  the  victim,  warn  the  victim  and  law 
enforcement,  or  determine  if  there  are  grounds  for  civil  commitment  based 
on  the  patient’s  dangerousness  to  others.150 

In  states  with  permissive  legislation  and  law  interpretations,  the  first  two  options 
present  several  legal  and  moral  complications.  If  the  therapist  does  not  warn  or  notify  the 
proper  authorities  and  a  third  person  becomes  a  victim,  the  therapist  may  be  legally 
responsible  since  most  states  with  permissive  laws  only  cover  the  therapist  from  liability 
when  a  warning  is  made.  Many  of  these  state  laws  do  not  cover  the  therapist  from 
liability  when  confidentiality  is  not  breached,  when  valid  reasons  to  warn,  and  then  a 
third  party  victim  is  created.  From  a  therapeutic  standpoint,  moral  and  treatment 
considerations  may  prevent  the  therapist  from  making  a  permissive  notification,  even 
when  discharging  a  permissive  duty  to  warn  may  be  the  safest  course  of  action.  “This 
moral  basis  serves  as  the  foundation  for  legal  duties  to  protect,  which  specify  cases  where 
legal  requirements  of  clinician-patient  confidentiality  are  removed  to  allow  a  clinician  to 
try  and  avert  harm  to  an  identifiable  victim.”151 

The  third  type  of  jurisdiction  involves  states  with  no  statutory  law  or  legal 
guidance.  These  states  create  a  more  challenging  environment  for  therapists  than  the  two 
previous  categories.  Without  an  affirmative  duty  to  warn  or  protect,  or  a  legal  permissive 
ability  to  breach  confidentiality,  therapists  in  these  states  are  in  a  very  precarious 
position.  If  therapists  breach  confidentiality,  they  may  be  open  to  civil  litigation.  If  the 
therapists  fail  to  warn  a  potential  victim,  they  may  also  be  open  to  civil  litigation.  These 
two  possibilities  are  in  addition  to  the  complexities  involved  in  treating  patients  with 
violent  potential,  and  preventing  them  from  victimizing  others. 

A.  TARASOFF— THE  ORIGIN  OF  DUTY  TO  WARN 

The  terms  “duty  to  warn”  and  “duty  to  protect”  were  born  of  a  series  of  incidents, 
and  subsequent  legal  maneuvers,  in  California  in  the  late- 1960s  and  mid- 1070s.  The 


150  Johnson,  Govind,  and  Sisti,  “The  Tarasoff  Rule:  The  Implications  of  Interstate  Variation  and  Gaps 
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events  of  concern  were  litigated  in  the  California  case  of  Tarasoff  v.  Regents  of 
University  of  California.152  The  case  involves  the  murder  of  a  woman  at  the  University  of 
California  (UC)  Berkeley  by  a  student  who  had  been  under  psychiatric  care.  This  seminal 
case  was  the  first  to  use  the  terms  “duty  to  warn”  and  “duty  to  protect”  in  legal 
jurisprudence.  It  is  also  the  forerunner  of  all  current  duty-to-wam  and  -protect  state  laws. 
As  a  result,  the  topic  of  duty  to  warn  or  protect  is  frequently  referred  to  as  relating  to 
Tarasoff,  even  though  the  Tarasoff  case  only  directly  applied  to  the  state  of  California. 

The  details  are  compelling.  Tatiana  Tarasoff,  also  known  as  Tanya,  was  bom  in 
China  to  Russian  parents,  as  shown  in  Figure  3.  The  family  then  moved  to  Brazil  until 
relocating  to  Berkeley,  California,  in  1963. 153 


Figure  3.  Tatiana  Tarasoff.154 


Prosenjit  Poddar,  seen  in  Figure  4,  was  raised  in  a  small  village  in  northern  India 
and  was  a  member  of  the  Harijan  (untouchable)  caste.  Poddar  graduated  from  the  Indian 
Institute  of  Technology  in  1961  and  relocated  to  Berkeley  in  1967  as  a  graduate  student 


152“Tarasoff  v.  Regents  of  University  of  California — 17  Cal.  3d  425 — Thu,  07/01/1976|California 
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studying  naval  architecture.  Poddar  lived  in  the  International  Student  House  (ISH)  at  UC 
Berkeley.155 


Figure  4.  Prosenjit  Poddar.156 


It  has  been  reported  that  Poddar  experienced  a  hard  time  transitioning  from  his 
home  culture  to  American  culture.  This  challenge  was  probably  made  more  complicated 
by  his  being  born  into,  and  raised,  in  the  Harijan  caste.  It  was  noted  that  Poddar,  who  had 
previously  attended  all-male  schools,  was  especially  challenged  by  the  cultural 
differences  in  terms  of  relationships  with  women.157 

In  1968,  Tarasoff  and  Poddar  met  at  the  ISH  while  Tarasoff  was  attending  folk 
dancing  classes.  On  New  Year’s  Eve,  Tarasoff  kissed  Poddar,  which  led  him  to  believe 
that  she  was  interested  in  him  romantically.  When  Poddar  pursued  Tarasoff,  she  declined 
his  advances.  Poddar  became  infatuated  with  Tarasoff.  When  Poddar  learned  that 
Tarasoff  was  engaged  in  sexual  relationships  with  other  men,  his  mental  condition  began 
to  decline.  Poddar  began  missing  classes  and  work,  and  began  spending  time  alone  in  his 


155  Rothstein,  “Tarasoff  Duties  after  Newtown,”  104-9. 
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54 


room.  In  the  summer  of  1969,  Tarasoff  left  to  spend  the  summer  in  Brazil.  While  she  was 
gone,  a  friend  of  Poddar’s  encouraged  him  to  seek  treatment.158 

Poddar  sought  help  at  Cowell  Memorial  Hospital  at  UC  Berkeley.  During 
treatment  under  the  supervision  of  Dr.  Lawrence  Moore,  Poddar  disclosed  that  he  was 
going  to  kill  a  woman  named  Tatiana.  Case  law  indicates  that  the  intended  victim  was 
“readily  identifiable”  by  Moore.159  Moore  diagnosed  Poddar  with  paranoid  schizophrenia 
and  consulted  with  colleagues.  Believing  that  Poddar  presented  a  danger  to  himself  and 
others,  Moore  contacted  the  UC  Berkeley  police  and  asked  that  they  take  Poddar  into 
custody.  Moore  further  advised  that  he  would  commit  Poddar.  Campus  police  officers 
detained  Poddar  in  his  room.  During  the  encounter,  the  police  officers  determined  that 
Poddar  appeared  rational,  instructed  him  to  stay  away  from  Tatiana,  and  did  not  transport 
him  for  commitment.  Moore’s  supervisor  instructed  that  all  therapy  notes  be  destroyed 
and  instructed  that  no  further  attempts  to  commit  Poddar  be  attempted.  Poddar  stopped 
participating  in  treatment.160 

Upon  her  return  to  Berkeley,  Tarasoff  was  open  concerning  her  romantic 
escapades  in  Brazil.  Upon  learning  of  Tarasoff  s  involvement  with  other  men,  Poddar’s 
mental  state  continued  to  deteriorate.  On  October  27,  1969,  Poddar  armed  himself  with  a 
pellet  gun  and  a  knife,  and  went  to  Tarasoff  s  residence.  Poddar  chased  Tarasoff  into  the 
back  yard  and  fatally  stabbed  her  17  times.  Poddar  then  went  back  inside  and  called  the 
police,  who  responded  and  arrested  him.161 

Poddar  was  initially  charged  with  murder,  and  was  convicted  of  second-degree 
murder  in  spite  of  his  defense  of  insanity.  Poddar  appealed,  and  a  California  Court  of 
Appeals  lowered  the  initial  conviction  to  manslaughter.  A  new  trial  was  ordered  when  it 
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was  determined  that  the  judge  in  the  first  case  failed  to  provide  adequate  instructions  to 
the  jury  concerning  the  issue  of  diminished  capacity.  Poddar  was  never  re-tried,  and 
California  ultimately  allowed  him  to  leave  the  United  States  and  return  to  India.162 

Tarasoff  s  parents  later  brought  a  civil  suit  against  the  University  of  California  for 
wrongful  death.  The  initial  case  was  dismissed,  and  the  Tarasoffs  appealed.  The 
California  Court  of  Appeals  affirmed  the  lower  court’s  decision  and  found  in  favor  of  the 
defendants,  that  is,  the  university.  The  case  was  appealed  again  in  front  of  the  California 
Supreme  Court.  This  time,  the  court  agreed  with  the  Tarasoffs  and  detennined  that  the 
defendants  should  have  warned  Tatiana  of  the  risk.  In  doing  so,  the  California  Supreme 
Court  applied  the  legal  theory  of  “duty  to  warn”  to  the  therapists.163 

Due  to  the  controversial  nature  of  the  court’s  first  opinion,  and  in  an  unusual 
maneuver,  the  California  Supreme  Court  agreed  to  take  a  second  look  at  its  Tarasoff 
decision.164  As  unusual  as  it  was  for  the  California  Supreme  Court  to  agree  to  a  rehearing 
of  the  case,  it  became  even  more  unusual  when  the  second  decision  expanded  on  the 
decision  of  Tarasoff  1.  The  decision  in  Tarasoff  2  expanded  the  duty  to  warn  in  decision 
of  Tarasoff  1  to  the  “duty  to  protect.”  The  case  decisions  are  sometimes  referred  to  as 
Tarasoff  1  and  Tarasoff  2. 165 

Tarasoff  2  looked  at  all  the  causes  for  action  claimed  by  the  plaintiffs  (Tarasoffs), 
and  decided  to  focus  on  one,  the  “Failure  to  warn  on  a  dangerous  patient.”166  The 
defendants  in  the  case  contended  that  they  had  “no  duty  of  care  to  Tatiana  or  her  parents 
and  that  in  the  absence  of  such  duty,  they  were  free  to  act  in  careless  disregard  of 
Tatiana’s  life  and  safety.”167 
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In  its  analysis,  the  court  detennined  that  the  most  important  consideration  in  terms 
of  a  failure  to  warn  on  behalf  of  the  defendants  was  the  issue  of  foreseeability.  According 
to  the  opinion  provided  by  Judge  Tobriner  in  the  case,  “As  a  general  principle,  a 
‘defendant  owes  a  duty  of  [17  Cal.  3d  435]  care  to  all  persons  who  are  foreseeably 
endangered  by  his  conduct,  with  respect  to  all  risks  which  make  the  conduct 
unreasonably  dangerous.’”168  The  court  further  noted  that  historically,  affirmative  action 
had  been  required  if  the  defendant  had  a  “special  relationship”  with  either  the  individual 
posing  a  danger,  or  the  intended  victim.  The  relationship  between  a  therapist  and  a  patient 
qualified  as  a  special  relationship,  which  left  the  issue  of  whether  therapists  should  have 
foreseen  their  client’s  future  action.169 

The  defense  counter-argued  that  therapists  cannot  predict  whether  a  patient  will 
act  violently  in  the  future  with  any  degree  of  accuracy,  and,  in  fact,  practitioners  likely 
would  over-report  their  concerns.170 

In  support  of  this  argument  amicus  representing  the  American  Psychiatric 
Association  and  other  professional  societies  cites  numerous  articles  which 
indicate  that  therapists,  in  the  present  state  of  the  art,  are  unable  reliably  to 
predict  violent  acts;  their  forecasts,  amicus  claims,  tend  consistently  to 
over-predict  violence,  and  indeed  are  more  often  wrong.171 

The  court  determined  that  making  diagnoses  is  a  central  function  of  psychiatrists 
and  psychologists,  and  in  doing  so,  these  practitioners  do  routinely  make  predictions. 
According  to  the  court’s  decision,  “Thus  the  judgment  of  the  therapist  in  diagnosing 
emotional  disorders  and  in  predicting  whether  a  patient  presents  a  serious  danger  of 
violence  is  comparable  to  the  judgment  which  doctors  and  professionals  must  regularly 
render  under  accepted  rules  of  responsibility.”172  The  court  did  recognize  the  difficulty 
inherent  in  the  process  of  predicting  behavior,  and  noted  that  a  perfect  perfonnance  on 
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the  part  of  therapists  was  not  expected  or  necessary.  The  actions  of  a  therapist  in  making 
predictions  must  only  be  reasonable  in  the  context  of  the  circumstances  and  as 
comparable  to  others  in  the  field.  The  court  also  pointed  out  that  the  defendants  in  the 
Tarasoff  case  did  accurately  predict  Poddar’s  violent  behavior  and  the  threat  he  posed, 
but  failed  to  warn  or  protect  the  victim. 

The  significant  conclusion  of  the  court’s  decision  was  the  detennination  that  once 
a  therapist  does  determine  that  a  patient  poses  a  threat  to  another  (or  should  have 
determined  based  on  the  reasonableness  of  the  circumstances  and  common  practice),  the 
therapist  is  responsible  to  act  upon  a  duty  to  protect  the  threatened  party.173  This 
expansion  of  the  duty  to  warn  to  a  duty  to  protect  increases  the  affirmative  action  that  a 
therapist  must  take  to  protect  a  third  party  by  imposing  duties  in  addition  to  a  warning. 
The  court  opined  that  the  risk  of  predicting  false  warnings  was  overshadowed  and  made 
reasonable  by  the  potential  for  the  saving  of  lives  and  protecting  third  parties  from 
danger. 

In  regards  to  the  crucial  nature  involved  in  protecting  confidential 
communications  between  therapists  and  their  patients,  the  court  acknowledged  the 
importance  of  confidentiality  and  the  role  it  plays  in  the  successful  treatment  of  patients, 
but  weighed  the  interest  of  the  confidentiality  against  the  welfare  of  the  public  and  the 
need  to  protect  the  public  from  future  acts  of  violence.174 

In  providing  the  majority  decision  for  the  case,  Judge  Tobriner  authored  the  now 
famous  lines,  “We  conclude  that  the  public  policy  favoring  protection  of  the  confidential 
character  of  patient-psychotherapist  communications  must  yield  to  the  extent  to  which 
disclosure  is  essential  to  avert  danger  to  others.  The  protective  privilege  ends  where  the 
public  peril  begins.”175 
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B.  MARYLAND  DUTY  TO  WARN  AND  PROTECT  LAW 

Maryland  is  a  mandatory  duty-to-protect  state.  The  affirmative  nature  of  the  duty 
may  differ  from  other  states  in  that  it  provides  for  options  in  which  a  therapist  may  act 
and  does  not  specifically  dictate  which  option  the  therapist  must  choose.  The  statute  is 
located  in  Maryland’s  Courts  and  Judicial  Proceedings  Section  §5-60. 176 

Section  (a)  of  the  statue  defines  to  whom  the  law  applies.  Mental  health  care 
providers  who  must  be  licensed  in  the  state  are  covered  by  the  law.  Definitions  of  who 
must  be  licensed  are  provided  in  the  Health  Occupations  Statute  under  Section  §17- 
101. 177  Licensing  requirements  for  social  workers  may  be  found  under  the  Health 
Occupations  Statute  under  Title  19-Social  Workers  Subtitle  3-Licensing  Title  §19-301. 178 

Section  §5-609  defines  a  mental  health  care  provider  as,  “a  mental  health  care 
provider  licensed  under  the  Health  Occupations  Article  or  any  facility,  corporation, 
partnership,  association,  or  other  entity  that  provides  treatment  or  services  to  individuals 
who  have  mental  disorders.”179 

Section  (b)  outlines  the  mandated  duty  to  protect  as  occurrences  when  a  mental 
health  care  provider  is  aware  that  a  patient  is  capable  of  violent  behavior  against  a  known 
victim  or  group  of  victims.  The  statue  provides  immunity  from  legal  or  disciplinary 
action  of  the  provider  for  discharge  of  the  duty  to  warn  or  protect.  Section  (b)  also 
describes  the  manner  in  which  a  provider  may  come  to  know  of  the  threat  posed  by  a 
patient  as  the  patient’s  spoken  word,  writing,  or  conduct.180 
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Section  (c)  (2)  provides  the  options  for  the  discharge  of  the  duty  that  a  provider 
may  take.  The  statue  allows  for  discretion  on  the  part  of  the  provider  either  to  seek 
commitment  of  the  patient,  construct  a  treatment  plan  to  address  the  potential  violence, 
inform  a  LE  agency  of  the  danger  posed  by  the  patient,  or  warn  the  intended  victim(s).  If 
the  provider  decides  to  provide  a  warning  to  LE  or  the  intended  victim(s),  the  stature 
delineates  that  the  warning  must  include  the  nature  of  the  threat,  identity  of  the  patient, 
and  the  identity  of  the  intended  victim(s).  As  a  result,  Maryland’s  law  is  both  a  duty  to 
warn  and  a  duty  to  protect  statute.  The  law  is  mandatory  in  requiring  the  therapist  to  take 
action  to  protect,  but  allows  discretion  in  how  the  provider  discharges  the  duty.  The  law 
also  states  that  the  actions  taken  by  the  provider  must  be  both  reasonable  and  timely.181 

C.  ANALYSIS  AND  APPLICATION  TO  CVE 

Confidentiality  is  a  vital  component  of  the  therapist/patient  relationship.  Without 
the  trusting  relationship  created  by  the  existence  of  confidentiality,  patients  in  need  of 
treatment  may  not  seek  it,  patients  may  not  disclose  all  information  needed  for  the  mental 
health  worker  to  diagnose  and  treat  the  patient  properly,  and  patients  may  stop  treatment 
(as  was  seen  with  Poddar).  The  reasons  for  the  confidentiality  and  trust  are  also  a  benefit 
to  society  when  they  facilitate  the  successful  diagnosis  and  treatment  of  the  mental  health 
patient. 

This  balance  of  trust  with  the  responsibility  to  protect  others  from  their  patient’s 
potential  violent  acts  creates  a  precarious  responsibility  for  therapists.  The  element  of  risk 
lies  inherent  in  both  the  treatment  of  the  patient  and  the  protection  of  the  public.  When 
treating  patients  vulnerable  to  radicalization,  engaged  in  radicalization,  or  radicalized,  the 
threat  of  danger  to  others  and  the  risk  to  the  patient  are  always  present. 

A  therapist  must  first  diagnose  a  patient  before  administering  treatment.  In  cases 
where  the  patient  has  indicated  a  threat  to  others,  the  therapist  must  determine  if  the 
threat  is  viable.  A  determination  of  whether  the  patient  intends  to  carry  out  the  threat,  or 
is  just  venting  frustration  must  be  made.  The  therapist  must  determine  if  the  patient  has 
the  means  to  carry  out  the  threat.  For  example,  a  patient  threatening  to  kill  his  wife  with 
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whom  he  resides  may  be  more  credible  than  a  threat  to  kill  an  ex-girlfriend  who  resides 
on  another  continent. 

Many  state  laws,  such  as  Maryland’s,  require  that  the  threat  posed  by  the  patient 
be  imminent,  but  provide  no  definition  of  what  that  means.  The  therapist  must  determine 
the  imminence  of  their  patient’s  threat  to  another.  Without  guidance  on  what  constitutes 
imminent,  practitioners  are  left  to  their  own  devices  to  make  the  determination. 

As  a  result,  mental  health  providers  are  responsible  for  treating  patients  suffering 
from  mental  health  disorders,  successfully  diagnosing  the  disorder,  creating  a  treatment 
plan,  enacting  the  plan,  monitoring  the  progress  and  adjusting  as  necessary,  and  being 
wary  of  danger  the  patient  may  pose  to  others.  In  the  situations  when  the  patient  poses  a 
danger,  the  practitioners  must  understand  the  boundaries  of  the  law  in  the  state  in  which 
they  are  practicing,  determine  if  the  threat  is  imminent,  and  then  detennine  what  to  do. 
Risk  assessment  is  a  constant  element  in  all  phases  of  the  therapist’s  role. 

Maryland’s  duty  to  protect  law  applies  to  CVE  practitioners  providing  therapy  to 
referred  clients.  As  licensed  social  workers  or  therapists,  CVE  practitioners  are  working 
in  an  environment  rife  with  risk,  and  are  bound  by  the  duty  to  protect  others.  As  such, 
when  licensed  mental  health  providers  working  in  the  CVE  field  in  Maryland  are  treating 
patients,  they  must  detennine  if  the  patient  poses  a  threat  to  others.  The  threat  may  be 
communicated  in  words,  writing,  or  other  action. 

Even  though  Maryland’s  law  mandates  an  affirmative  action  on  the  part  of  the 
provider,  the  law  allows  for  discretion  on  the  part  of  the  provider  in  the  fonn  of  options 
which  may  be  applied.  In  Maryland,  providers  are  not  mandated  to  warn  the  victim, 
although  they  may  elect  to  do  so.  Maryland’s  law  allows  for  the  provider  to  address  the 
threat  by  having  the  patient  civilly  committed  for  further  treatment,  establishing  a  more 
robust  treatment  plan,  or  making  notification  to  the  appropriate  LE  agency  and  the 
potential  victim. 
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Maryland’s  duty  to  protect  only  applies  to  future  crimes,  and  does  not  apply  to 
crimes  that  have  already  been  committed.  The  law  also  indicates  that  the  victim,  or 
victims,  must  be  identifiable.182 

The  decision  by  a  therapist  to  breach  confidentiality  remains  a  challenging  issue. 
Identifying  risk,  and  determining  the  seriousness  or  level  of  risk  remains  critical.  A 
possibility  exists  that  therapists,  who  are  ethically  and  morally  bound  to  protect  the 
confidentiality  of  their  patients,  may  be  more  inclined  to  try  and  treat  patients  as  their 
choice  of  options,  when  in  fact,  the  more  appropriate  response  might  have  been  to  warn 
the  victim  and  alert  LE  of  the  danger.  While  discretion  is  important  in  both  mental  health 
care  and  LE,  some  practitioners  may  elect  to  take  what  they  believe  is  the  safer  ethical 
route  and  treat  the  patient  as  their  response  to  discharging  their  protective  duty. 

The  fields  of  mental  health  and  LE  are  frequently  misunderstood  in  general,  and 
practitioners  in  both  fields  frequently  do  not  possess  an  adequate  understanding  or 
appreciation  of  the  other  field.  Corbin,  Wexler,  and  Winick  point  out  the  conflict  between 
the  two  professions  while  highlighting  the  importance  of  cooperation.183  Mental  health 
and  LE  will  always  overlap.  The  theory  of  therapeutic  justice  seeks  to  educate 
practitioners  in  both  fields  on  the  work  of  the  other,  and  bring  the  two  disciplines  closer 
together.  Both  fields  possess  the  same  super-ordinate  goal  of  helping  others,  but  a  lack  of 
understanding  or  cooperation  may  block  the  efforts  of  one  field  instead  of  creating  a 
complimentary  union. 

Practitioners  in  both  fields  are  motivated  and  bound  by  ethical  and  moral  values. 
Both  fields  are  also  impacted  by  laws  that  regulate  or  permit  actions  taken  in  pursuit  of 
the  specific  field’s  goals,  while  still  under  the  shadow  of  the  broad  goal  of  helping  others. 
Therapists  focus  on  their  patients,  and  LE  may  focus  on  victims.  The  victims  are 
sometimes  the  therapists’  patients,  and  at  other  times,  victims  may  be  created  by  these 
patients.  In  terms  of  confidentiality  and  treatment  of  their  patients,  therapists  are  bound 
by  both  ethical  and  legal  means.  It  is  therefore  important  for  LE  professionals  to 

182  Beth  Tabachnick,  “Maryland  Duty  to  Protect/Warn”  (PowerPoint,  CVE  Practitioner 
Confidentiality  Training,  Montgomery  County,  Maryland,  2016). 

183  Wexler,  “Two  Decades  of  Therapeutic  Jurisprudence,”  17. 
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understand  the  role  of  the  therapist  and  the  benefit  to  society  of  the  successful  treatment 
provided  by  the  therapist.  The  therapist,  on  the  other  hand,  must  understand  that  at  some 
point,  the  protection  of  society  may  outweigh  the  individual  patient.  In  short,  a  balance 
must  exist  between  the  obligation  the  therapists  have  to  their  clients  and  the  safety  of  the 
public.  As  noted  by  the  second  Tarasoff  decision,  the  balance  must  always  tip  in  favor  of 
public  safety  as  a  whole.  The  protected  privilege,  should  in  fact,  end  where  the  public 
peril  begins. 


63 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


64 


IV.  MULTI-DISCIPLINARY  APPROACH 


CVE  programs  are  designed  to  operate  as  collaborative  entities.  The  models  bring 
together  various  entities  and  experts  who  may  not  normally  work  together.  The  models 
are  designed  to  apply  all  the  correct  resources  deemed  necessary  to  achieve  the  goals  of 
the  program.  This  approach  does,  however,  create  challenges  for  organizing,  managing, 
and  ensuring  the  entities  complement  each  other,  remain  focused  on  the  goal,  and 
collaborate  effectively.  Two  of  the  main  groups  involved  in  CVE  are  represented  by  LE 
and  mental  health  practitioners.  As  referenced  earlier,  conflict  and  cooperation  between 
the  two  groups  have  previously  existed  in  various  venues.  CVE  adds  additional 
ingredients  to  the  pot  by  including  additional  resources  and  disciplines.  Fortunately, 
collaborative  models  have  been  used  successfully  in  other  areas. 

As  the  FBI  has  prepared  to  refer  individuals  to  CVE  programs  for  intervention, 
the  agency  has  begun  referring  to  the  intervention  practitioners  as  a  MDT.  The  definition 
fits,  but  as  shall  be  seen,  the  method  and  application  as  used  by  the  FBI  may  not  be 
appropriate. 

For  many  years,  different  fields  have  relied  on  multidiscipline  efforts  to  find  the 
best  approach  to  a  super-ordinate  goal.  MDTs  are  sometimes  also  referred  to  as 
interdisciplinary  teams,  but  the  two  are  actually  somewhat  different,  and  the  definition 
sometimes  depends  on  the  discipline  in  which  it  is  used.  MDTs  have  historically  been 
used  in  the  fields  of  private  industry,  health  care,  special  education,  and  for  child  abuse 
investigations. 

MDTs  are  typically  composed  of  a  group  of  professionals  from  different  fields 
who  share  a  common  goal,  but  contribute  different  areas  of  expertise  to  the  effort.  In  the 
field  of  medicine,  interdisciplinary  teams  may  be  defined  as,  “a  group  of  healthcare 
professionals  from  diverse  fields  who  work  in  a  coordinated  fashion  toward  a  common 
goal  for  the  patient,”  as  opposed  to  a  MDT  defined  as,  “a  team  of  professionals  including 
representatives  of  different  disciplines  who  coordinate  the  contributions  of  each 
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profession,  which  are  not  considered  to  overlap,  in  order  to  improve  patient  care.”184  In 
the  United  States,  MDTs  have  been  used  in  hospitals  for  more  than  50  years.185 

The  MDT  approach  identifies  practitioners  with  critical  responsibilities  to  an 
issue,  and  brings  those  practitioners  together  to  form  a  team.  The  practitioners  represent 
agencies  that  have  a  stake  in  the  solution  of  the  challenge.  The  practitioners  are  brought 
together  as  subject  matter  experts  on  their  aspect  or  interest  in  the  issue.  The  goal  is  to 
form  a  team  of  experts  where  each  expert  represents  a  different  discipline  for  the  purpose 
of  collaborating  on  complex  challenges.  One  of  the  assumptions  of  the  effort  is  that 
individual  practitioners  would  not  benefit  from  the  expertise  of  team  members  from 
different  disciplines  if  the  team  was  not  formed.  The  practitioners  represent  each  of  their 
disciplines  and  work  to  collaborate  the  efforts  of  their  organizations  with  the  partner 
agencies.  The  goal  is  to  create  a  common  plan  to  overcome  a  challenge  and  identify  the 
role  of  each  discipline. 

MDTs  have  been  used  in  the  United  Stated  for  several  decades,  with  a  high  level 
of  success,  in  the  area  of  physical  and  sexual  child  abuse.  The  MDT  approach  was  first 
applied  to  child  sexual  abuse  in  the  1980s  by  the  National  Children’s  Advocacy  Center 
(NCAC)  in  Huntsville,  Alabama.  At  the  time,  social  services  providers,  members  of  the 
criminal  justice  system,  and  LE  officers  were  not  effectively  working  together  to  address 
child  sexual  abuse  issues.  Members  of  these  different  disciplines  pursued  the  same  super¬ 
ordinate  goal  of  protecting  children,  but  the  services  provided  were  different,  and  what 
others  were  doing  was  not  clear,  or  the  mission  of  other  practitioners  was  not  really 
known  either.  A  district  attorney  and  now  former  Congressman  from  Alabama,  Bud 
Cramer,  recognized  the  lack  of  coordination,  and  assisted  in  forming  MDTs  with  the 
various  disciplines.  Cramer  organized  representatives  from  the  fields  of  child  protective 
services  (CPS),  LE,  medical  and  mental  health  practitioners,  and  attorneys  and  formed 
the  first  MDT  for  assisting  child  victims.  The  formation  of  the  MDT  also  created  the  first 
child  advocacy  center  (CAC),  which  evolved  into  a  coordinated  center  where  all  aspects 

18477ie  Free  Dictionary,  “Multidisciplinary  Team.” 

185  Mark  Ellis,  Forming  a  Multidisciplinary  Team  to  Investigate  Child  Abuse  (Washington,  DC:  U.S. 
Department  of  Justice,  Office  of  Justice  Programs,  Office  of  Juvenile  Justice  and  Delinquency  Prevention, 
2000),  4,  http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2518713. 
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involved  with  the  response  to  sexual  crimes  committed  against  children,  as  shown  in 
Figure  5,  could  be  addressed.186 


HOW  THE  MULTIDISCIPLINARY  TEAM  RESPONDS  TO  CHILD  ABUSE 


District  Attorney's  Office 


9  Responds  to  reports  of  chid  abuse,  nvestgates  the  allegations  n  conjunction  with  law  enforcement  and  works  to  ensure  cNdren  are  safe 
O  Responds  to  reports  of  chid  abuse,  nvesbgates  the  allegations  n  conjunction  with  DHR,  and  makes  arrests  when  appropriate 
O  Interviews  children  who  may  have  experienced  abuse,  using  a  nationally-recognized  forensic  nterview  model  developed  by  NCAC 
O  Provides  non-invashre  physical  exams  for  chldren  with  allegations  or  concerns  of  abuse 

O  Provides  the  parertsi'caregrvers  of  children  who  pamepate  in  a  forensic  interview  with  support  and  education  about  the  investigation  and  criminal 
justice  process,  ongoing  support,  and  Inkage  to  commwity  resources 

O  Reviews  cases  with  members  of  Multdisciplnary  Team  to  guide  the  chW  abuse  rrvesbgations.  determines  whether  prosecution  n  crwwial  court  is 
appro  prate,  and  prepares  cases  for  tnal 

O  Provides  evidence-based  and  trauma-focused  mental  health  treatment  to  children  who  have  experienced  abuse  or  other  traumatize  events 


Figure  5.  NCAC  Organizational  Chart.187 


According  to  the  NCAC: 

This  innovative  model  recognized  that  in  order  for  the  United  States  to 
effectively  respond  to  this  issue  that  a  unique  public-private  partnership 
was  essential,  and  that  the  various  agencies  and  departments  responsible 

186  “National  Children’s  Advocacy  Center  History,”  accessed  July  11,  2016,  http://www.nationalcac. 
org/table/about/history/. 

Source:  National  CAC,  “Multidisciplinary  Team.” 
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for  the  protection  of  children  must  be  united  in  a  collaborative  effort  to 
respond  with  the  recognition  that  no  one  agency  by  itself  could  assure  the 
protection  of  children.188 

This  new  approach  was  received  with  a  certain  amount  of  uncertainly  by  members 
of  the  different  involved  groups.  Eventually,  members  of  the  MDT  grew  to  appreciate  the 
strength  of  the  team.  A  greater  understanding  of  different  roles  and  an  appreciation  for 
the  collaborative  approach  became  obvious.  Since  that  time,  the  CAC  model  of  MDT  has 
spread  to  over  950  CACs  in  the  United  States  and  to  over  25  other  countries.189 

The  investigation  and  response  to  the  report  of  child  abuse  is  a  complicated  and 
complex  endeavor  that  necessitates  the  involvement  of  numerous  different  professionals 
from  various  different  disciplines.  The  members  of  each  area  represent  different,  but 
aligned,  missions  with  the  same  goal  of  protecting  and  assisting  the  victim. 

LE  is  obviously  tasked  with  the  investigation  of  reported  child  abuse  crimes.  CPS 
social  workers  also  investigate  the  reports  of  abuse  and  neglect,  and  frequently  do  so  in 
conjunction  with  LE.  Interviewing  children  in  general,  and  especially  children  who  may 
be  the  victims  of  horrible  crimes,  requires  a  very  specialized  skill  set.  CPS  social 
workers,  who  are  typically  specially  trained  to  conduct  interviews  with  children,  often 
conduct  the  interviews  on  behalf  of  LE.  In  the  world  of  LE,  it  is  rare  that  a  professional 
from  another  field  is  relied  upon  so  heavily  to  contribute  such  an  important  part  of  an 
investigation.  As  a  result,  a  strong  relationship  between  the  LE  and  CPS  workers  is  more 
than  essential. 

Medical  and  mental  health  professionals  are  brought  into  the  equation  to  provide 
treatment,  but  are  also  used  to  gather  both  physical  and  testimonial  evidence.  In 
jurisdictions  with  CACs,  specially  trained  pediatricians  and  nurses  work  in  the  Center  to 
assess,  treat,  and  document  injuries  and  evidence  in  conjunction  with  their  evaluation  of 
the  victim.  In  other  jurisdictions,  the  victims  are  brought  to  a  hospital  where  the  attending 
physician  may,  or  may  not,  have  experience  in  treating  the  victims  of  child  abuse,  or 
sexual  abuse. 

188  National  CAC,  “Multidisciplinary  Team.” 

189  Ibid. 
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Prosecutors  and  government  attorneys  representing  children  also  have  a  place  in 
the  response  to  child  abuse.  In  many  jurisdictions,  when  responding  to  crimes  of  a  serious 
nature,  prosecutors  are  frequently  involved  in  the  investigation.  When  dealing  with  the 
unique  and  fragile  nature  of  child  abuse  investigations,  prosecutors  are  frequently 
involved  to  assess  the  value  of  evidence  and  provide  guidance.  Other  government 
attorneys  are  also  involved  in  other  legal  areas  involving  children,  such  as  custody  and 
civil  court  proceedings. 

When  addressing  matters  representing  a  high  level  of  seriousness,  such  as  child 
abuse,  teamwork  is  essential.  To  accomplish  overall  goals,  the  creation  or  fonnation  of  a 
team  is  very  important.  In  addition  to  coordinating  the  various  roles  of  team  members, 
well-functioning  child  abuse  MDTs  frequently  move  into  the  arenas  of  group  decision 
making,  policy  evaluation  and  recommendations,  and  coordinated  strategies  to  apply  to 
individual  cases.190 

Some  of  the  recognized  benefits  to  child  abuse  MDTs  include: 

•  Leaner  and  more  efficient  use  of  scarce  resources 

•  Better  decisions  made  by  groups  with  pertinent  and  multifaceted 
experience 

•  Better  investigative,  prosecutorial,  and  treatment  outcomes 

•  Better  understanding  of  roles  and  responsibilities  leading  to  increased 
positive  outcomes 

•  A  higher  level  of  community  respect 

•  Lower  levels  of  burnout  and  turnover  among  team  members 

•  Lower  amount  of  exposure  to  multiple  agencies  by  victims191 

Once  the  importance  of  the  use  of  MDTs  in  child  abuse  investigations  has  been 
accepted,  the  next  step  involves  the  creation  and  maintenance  of  a  team.  Critical  steps  to 
forming  a  MDT  include: 

•  Identifying  and  recruiting  members 

190  Ellis,  Forming  a  Multidisciplinary  Team  to  Investigate  Child  Abuse. 

191  Ibid.,  4. 
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•  Creating  and  writing  a  mission  statement 

•  Creating  and  writing  policies  and  protocols 

•  Evaluating  the  impact  of  laws  on  the  group’s  mission 

•  Establishing  and  maintain  relationships 

1 92 

•  Evaluation 

In  Montgomery  County,  the  MDT  design  is  used  for  child  abuse  investigations 
and  treatment  plans.  Any  member  of  the  team  has  the  authority  to  call  a  MDT  meeting  to 
present  issues  related  to  a  case  for  the  team  to  discuss  with  the  intent  of  producing  a 
collective  agreement  on  a  path  forward. 

The  model  brings  together  representatives  from  the  County’s  DHHS’  child 
welfare  services,  police  department,  State’s  Attorney’s  Office,  County  Attorney’s  Office, 
and  the  Primary  Care  Coalition  of  Montgomery  County.  The  team  is  a  public  private 
partnership.  According  to  the  Montgomery  County  memorandum  of  understanding  and 
operational  agreement  for  the  Tree  House  Child  Assessment  Center  of  Montgomery 
County,  Maryland: 

This  agreement  is  set  forth  to  enable  the  Montgomery  County 

Multidisciplinary  Team  to  pursue  the  well-established  process  of  the 

interdisciplinary  approach  to  cases  of  child  maltreatment  which  includes, 

but  is  not  limited  to  the  following: 

A.  Sharing  information  and  resources  to  enhance  each  step  of  the  case 
intervention  process. 

B.  Responding  effectively  and  efficiently  to  all  child  protection  issues 
of  mutual  concern. 

C.  Ensuring  that  victims  and  their  families  receive  community-based 
services  in  a  timely  fashion  in  order  to  reduce  the  stress  on  the 
family  system. 

D.  Providing  an  environment  to  allow  each  discipline  to  bring  the 
training,  experience  and  resources  to  the  table  to  address  child 
maltreatment  and  case  management. 


192  Ellis,  Forming  a  Multidisciplinary  Team  to  Investigate  Child  Abuse. 
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E. 

Monitoring  collaborative  case  management  and  service  provision 
to  ensure  quality  of  treatment  to  support  healthy  outcomes. 

F. 

Enhancing  communication  between  and  among 
operations. 

all 

MDT 

G. 

Providing  opportunity  for  feedback  on  Tree  House 
operations. 

and 

MDT 

H. 

Conducting  peer  reviews  for  all  Tree  House  staff.193 

The  negative  consequences  of  the  failure  of  teamwork  and  cooperation  among 
disciplines  involved  in  the  investigation  and  response  to  child  abuse  involve  the 
continuation  of  child  victimization  and  the  possible  failure  to  detect  cases  of  child  abuse. 
In  1995,  a  New  York  State  commission  investigating  the  failure  to  prevent  the  death  of  a 
child  victim  determined  that  part  of  the  blame  was  due  to,  “an  appalling  lack  of 
communication  and  coordination  among  the  agencies  investigating  reports  of  possible 
abuse.”194  In  response,  the  commission  recommended  the  creation  of  legislation 
facilitating  the  sharing  of  information  among  MDT  members. 

The  number  of  reports  of  child  abuse  and  neglect  has  increased  over  the  last 
several  decades.  The  increase  in  cases  has  tested  the  limits  of  practitioners  and  agencies 
tasked  with  investigation  and  treatment.  According  to  a  report  issued  by  the  U.S. 
Department  of  Justice  (DOJ),  attention  to  these  cases  has  assisted  in  focusing  attention  on 
the  problem,  but  has  also  led  to  a  spectrum  of  accusations  varying  from  government 
overreach  to  government  inaction.195 

A.  APPLICATION  TO  CVE 

When  comparing  the  collaborative  efforts  of  CVE  programs  with  CACs,  many 
structural  and  goal  similarities  appear.  In  Montgomery  County,  the  MDT  structure 
already  exists,  and  many  of  the  partners  are  the  same  as  those  involved  in  the  county’s 


195  Montgomery  County,  Montgomery  County  Memorandum  of  Understanding  and  Operational 
Agreement  for  the  Tree  House  Child  Assessment  Center  of  Montgomery  County,  Maryland  (Montgomery 
County,  MD:  2013). 

194  Ellis,  Forming  a  Multidisciplinary  Team  to  Investigate  Child  Abuse,  2. 

195  Ibid.,  3. 
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CVE  program.  Child  abuse  and  radicalization  are  both  complex  issues  that  require 
collaborative  solutions.  In  Maryland,  the  law  was  amended  to  allow  for  the 
communication  between  partners  on  child  abuse  MDTs.196  Other  states  have  created  or 
altered  existing  law  for  the  same  purpose.  According  to  the  Department  of  Criminal 
Justice  Services  for  the  Commonwealth  of  Virginia,  “MDT  members  can  share 
information.  When  the  2004  General  Assembly  made  the  above-referenced  changes  to 
section  63.  2-1503  (K)  regarding  the  purpose  and  composition  of  child  abuse  and  neglect 
MDTs,  the  specifically  included  language  allowing  team  members  to  share 
information.”197 

According  to  its  strategic  plan,  the  BRAVE  model  in  place  in  Montgomery 
County  describes  itself  as  a  CII.198  “Collective  impact  is  a  framework  to  tackle  deeply 
entrenched  and  complex  social  problems.  It  is  an  innovative  and  structured  approach  to 
making  collaboration  work  across  government,  business,  philanthropy,  non-profit 
organizations  and  citizens  to  achieve  significant  and  lasting  social  change.”199  The  idea 
of  a  CII  was  first  written  about  in  the  Stanford  Social  Innovation  Review  in  2011. 
According  to  the  article,  five  key  elements  are  needed  for  a  successful  program:  a 
common  agenda,  shared  measurements  systems,  mutually  reinforcing  activities, 
continuous  communication,  and  a  backbone  support  organization.  See  Figure  6. 


19(1  State  of  Maryland,  22.  Medical  Records  Act— Duty  to  Hold  Confidential  and  Duty  to  Disclose  a 
Medical  Record,  Health-General  Article  §  §  4-301—4-309,  8-601. 

197  Virginia  Department  of  Criminal  Justice  Services,  Information  Sharing  and  the  Multidisciplinary 
Child  Abuse  Team  (Richmond,  VA:  Department  of  Criminal  Justice  Services,  2005),  2,  https://www.dcjs. 
virginia.gov/juvenile/resources/infoSharing.pdf. 

198  World  Organization  for  Resource  Development  and  Education  (WORDE),  The  Building  Resilience 
against  Violent  Extremism  (BRAVE)  Model — A  Collective  Impact  Initiative  That  Increases  Public  Safety 
and  Social  Cohesion,  12. 

199  “jhe  Collective  Impact  Framework  |  Collaboration  for  Impact,”  accessed  October  16,  2016,  http:// 
www.collaborationforimpact.com/collective-impact/. 
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Common  Agenda 

•  Keeps  all  parties  moving  towards  the  same  goal 

Common  Progress  Measures 

•  Measures  that  gert  to  the  TRUE  outcome 

Mutually  Reinforcing  Activities 

•  Each  expertise  is  leveraged  as  part  of  the  overall 

Communications 

•  This  allows  a  culture  of  collaboration 

Backbone  Organization 

•  Takes  on  the  role  of  managing  collaboration 


Figure  6.  Collective  Impact  Initiative.200 


CIIs  are  models  that  may  be  applied  to  organizational  structures  to  ensure  that 
practitioners  are  working  together  to  achieve  a  common  goal.  The  BRAVE  model  is 
currently  the  only  true  community  led  CVE  initiative  in  existence. 

B.  THE  FBI’S  SHARED  RESPONSIBILITY  COMMITTEES 

In  the  spring  of  2016,  media  sources  began  reporting  that  the  FBI  had  created 
SRCs  that  were  being  used  as  MDTs  to  control  and  facilitate  the  actions  of  CVE 
practitioners  involved  in  intervention  efforts  with  individuals  referred  by  the  FBI.  One 
source,  The  Intercept,  claimed  to  have  a  copy  of  a  letter  issued  by  the  FBI  to  CVE 
members  of  SRCs.  According  to  reports,  and  the  letter  itself,  the  FBI  was  seeking  to 
create  voluntary  SRCs  within  CVE  programs  to  define  the  boundaries  and  rules  regarding 
individuals  referred  from  the  FBI.201 

According  to  The  Intercept,  George  Washington  University  Professor  Seamus 
Hughes  advised: 


2()()  Source:  “The  Collective  Impact  Framework  |  Collaboration  for  Impact.” 

201  Cora  Currier  and  Murtaza  Hussain,  “Letter  Details  FBI  Plan  for  Secretive  Anti-Radicalization 
Committees,”  The  Intercept,  April  28,  2016,  https://theintercept.com/2016/04/28/letter-details-fbi-plan-for- 
secretive-anti-radicalization-committees/. 
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if  implemented  transparently,  the  SRCs  could  offer  the  promise  of  an  “off 
ramp”  for  people  on  the  road  to  radicalization  or  arrest.  ‘We  haven’t 
provided  families  with  any  tools  to  help  them.  Parents  are  taking  passports 
away,  bringing  their  kids  to  local  imams,  but  these  are  ad  hoc  approaches 
set  up  to  fail  with  no  support  system  in  place.  Law  enforcement  is  given 
very  few  options  besides  arrest.  There  are  a  lot  of  attacks  on  heavy-handed 
counter-terrorism  approaches,  like  the  infonnants  and  agent  provocateurs, 
but  that’s  the  status  quo  now  until  we  have  other  options.202 

According  to  the  letter,  the  FBI  defines  SRCs  as,  “multi-disciplinary  groups 
voluntarily  formed  in  local  communities.”203  The  letter  outlines  how  the  FBI  may  refer 
“potentially  violent  extremists  for  intervention  so  long  as  the  SRC  operates  within  the 
FBI’s  rules.”204  The  FBI  has  not  confirmed  the  existence  of  the  letter  and  has  been 
accused  of  implementing  the  SRC  program  in  secrecy.  The  FBI  has  admitted  that  the 
SRC  program  is  a  limited  “pilot”  program  but  has  not  confirmed  where  the  program  is 
being  used.205 

According  to  the  letter  and  media  sources,  the  primary  goal  of  the  SRC  is 
disengagement  where  the,  “social  and  psychological  process  whereby  an  individual’s 
commitment  to  violence  as  a  solution  to  a  grievance  is  reduced  to  such  an  extent  that 
he/she  is  no  longer  at  risk  of  using  violence  as  a  solution  to  a  grievance.”206  The  letter 
claims  that  the  FBI’s  goal  in  referring  individuals  to  SRCs  is  not  to  alter  political  or 
religious  beliefs. 

Some  of  the  main  points  of  the  letter  include  the  following:207 

•  The  FBI  is  not  part  of  the  SRC. 

•  Once  the  FBI  refers  an  individual,  the  SRC  will  decide  if  appropriate 
treatment  may  be  applied. 


202  Hussain  and  McLaughlin,  “FBI’s  ‘Shared  Responsibility  Committees’  to  Identify  ‘Radicalized’ 
Muslims  Raise  Alarms.” 

203  “FBI-SRC-Letter,”  April  28,  2016,  https://www.documentcloud.org/documents/2815794-FBI- 
SRC-Letter.html. 

204  Ibid. 

205  Currier  and  Hussain,  “Letter  Details  FBI  Plan  for  Secretive  Anti-Radicalization  Committees.” 

206  “FBI-SRC-Letter.” 

207  Ibid. 
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The  SRC  will  then  be  responsible  for  designing  and  implementing  a 
treatment  plan. 


A  referral  will  not  preclude  the  FBI  from  conducting  an  investigation  of 
the  referred  subject;  however,  the  FBI  will  not  use  the  SRC  to  gather 
intelligence. 

The  FBI  will  not  share  investigative  details  with  the  SRC. 

Any  investigation  or  prosecution  may  be  conducted  without  notifying  the 
SRC. 

Once  a  referral  has  been  made,  members  of  the  SRC  may  share 
confidential  PHI  in  accordance  with  applicable  law. 

SRC  members  will  sign  confidentiality  agreements,  which  forbid  members 
from  discussing  the  FBI  referrals  with  anyone  outside  of  the  SRC  or  FBI, 
to  include  other  LE  members. 

The  onus  is  placed  on  SRC  members  to  reasonable  ensure  any  information 
passed  back  to  the  FBI  is  accurate. 

The  FBI  reserves  the  right  to  stop  making  referrals  to  the  SRC. 

The  SRC  may  share  best  practices  with  other  SRCs. 

SRC  members  may  not  seek  outside  consultation  with  other  experts  on  the 
treatment  of  referred  individuals  without  the  written  consent  of  the  FBI. 

The  FBI  will  not  disclose  the  identities  of  the  SRC  members  unless  legally 
required  to  do  so  (represents  another  form  of  risk  for  CVE  practitioners). 

SRC  members  will  be  required  to  sign  federal  form  FC-857  for  instances 
when  they  are  exposed  to  sensitive,  although  unclassified,  information. 

The  FBI  and  DOJ  will  provide  yearly  training  to  SRC  members  on  the 
handling  of  sensitive  information  and  materials. 

The  SRC  will  share  all  infonnation  on  the  referred  individuals  who  pose  a 
threat  of  violence  to  any  other  individual,  group,  or  the  public  in  a  manner 
consistent  with  applicable  laws. 

The  SRC  will  notify  the  FBI  when  a  referred  individual  is  not  responding 
to  treatment. 

SRC  may  notify  the  FBI  of  the  progression  of  treatment. 
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•  Any  information  shared  with  the  FBI  may  then  be  passed  on  to  other  LE, 
members  of  the  U.S.  intelligence  community,  or  representatives  of  foreign 
governments. 

•  Financial  and  civil  liability  resides  with  the  SRC  members  who  are 
required  to  provide  their  own  insurance  and  legal  representation  when 
needed. 

•  The  letter  of  agreement  makes  no  promise  of  funding. 

Referrals  made  by  the  federal  government  of  potentially  radicalized  individuals  to 
SRCs  would  most  likely  represent  a  small  but  critical  portion  of  treatment  by  CVE 
programs.  The  FBI  certainly  has  an  obligation  to  protect  the  integrity  of  its 
responsibilities.  The  manner  the  FBI  has  moved  forward  with  SRCs  and  the  construct  of 
the  agreement  letter,  however,  do  raise  some  concerns.  For  example,  one  of  the  main 
tenets  of  the  CVE  program  is  community  outreach.  Relationships  between  community 
and  government,  like  all  relationships,  are  based  on  trust.  A  semi-secret  implementation 
of  a  program  with  such  important  consequences  does  not  help  this  effort.  According  to 
the  Muslim  Public  Affairs  Council: 

This  lack  of  transparency  is  harmful  to  the  very  goal  the  FBI  is  trying  to 
achieve.  Any  individual  who  is  being  counseled  by  his/her  imam,  social 
worker,  or  therapist,  will  wonder  if  these  individuals  are  working  with  the 
FBI — an  entity  that  could  very  well  arrest  him/her  and  does  not  have  any 
actual  concern  for  his/her  well-being.208 

The  letter  also  appears  to  move  the  lion’s  share  of  risk  onto  SRCs.  This  level  of 
risk  does  not  create  an  atmosphere  where  the  most  qualified  practitioners  would  be  most 
willing  to  partake  in  risky  work  that  carries  such  an  important  role.  The  contents  of  the 
letter  also  do  not  create  a  trusting  relationship  between  the  FBI  and  the  various  public  and 
private  partners  engaged  in  CVE  endeavors.  The  letter  also  gives  the  FBI  the  appearance 
of  hypocrisy.  On  one  hand,  the  letter  claims  that  the  FBI  will  not  use  the  SRC  to  gather 
intelligence,  and  then  goes  on  to  strictly  set  the  rules  mandating  a  one-way  flow  of 
information  from  the  SCR  to  the  FBI.  Once  again,  the  FBI  has  a  responsibility  to  conduct 


208  Musiim  Public  Affairs  Council,  “The  Problem  with  the  FBI’s  ‘Shared  Responsibility 
Committees,’”  Muslim  Public  Affairs  Council,  March  31,  2016,  http://www.2fwww.mpac.org/policy- 
analysis/the-problem-with-the-fbis-shared-responsibility-committees.php. 
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its  business,  but  the  approach  taken  as  outlined  in  the  letter  does  not  create  a  trusting  and 
inclusive  relationship. 

The  FBI  will  possess  a  lot  of  information  concerning  its  referrals,  which  it 
understandably  will  not  be  able  to  share.  However,  successful  treatment  of  referred 
persons  also  requires  CVE  practitioners  be  infonned  of  certain  information  concerning  an 
individual  for  whom  they  will  creating  and  implementing  a  treatment  plan.  The  fact  the 
FBI  may  continue,  or  begin,  a  criminal  investigation  of  a  referred  individual  without  the 
SRC’s  knowledge  is  understandable;  however,  the  FBI’s  lack  of  presence  on  the  SRC  is 
not.  The  bottom  line  in  regards  to  the  letter  and  the  role  of  the  FBI  and  SRC  members  is 
that  it  appears  that  the  FBI  wants  its  cake,  and  to  eat  it  as  well,  and  to  deny  any  cake  to 
anybody  else. 

Much  of  the  criticism  of  the  FBI’s  SRC  program  has  come  from  civil  liberty  and 
watch  dog  agencies,  such  as  the  American-Arab  Anti-Discrimination  Committee  (ADC) 
and  the  Muslim  Public  Affairs  Council.209  The  ADC  has  demanded  that  the  FBI  cancel 
the  program.210  One  of  the  main  accusations  is  that  the  program  is  a  front  for  the 
expansion  of  FBI  infonnant  networks.  Unfortunately  for  the  FBI  and  CVE  programs,  this 
accusation  is  easy  to  make.  The  appearance  that  the  FBI  is  using  professionals  and 
communities  to  expand  surveillance  of  specific  communities  may  validate  existing  claims 
that  CVE  programs  stigmatize  and  unfairly  target  certain  portions  of  communities.  This 
phenomenon  also  runs  contrary  to  community  engagement  theories. 

The  FBIs  reference  to  CVE  practitioners  as  an  MDT  may  be  technically  accurate, 
but  the  FBI’s  approach  violates  the  spirit  of  MDTs.  MDTs  include  all  relevant 
practitioners  who  work  together  to  solve  problems  by  combining  the  expertise  of  all.  By 
not  including  itself  in  the  MDT,  the  FBI  is  excluding  its  expertise,  and  probably  some 
information  held  that  would  be  better  served  shared. 


209  “ADC  Demands  Cancellation  of  ‘Shared  Responsibility  Committees’  FBI  Informant  Program,” 
March  25,  2016,  http://www.adc.org/2016/03/adc-demands-cancellation-of-shared-responsibility-committ 
ees-fbi-informant-program/;  Muslim  Public  Affairs  Council,  “The  Problem  with  the  FBI’s  ‘Shared 
Responsibility  Committees.’” 

210  “ADC  Demands  Cancellation  of  ‘Shared  Responsibility  Committees’  FBI  Informant  Program.” 
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For  all  its  good  intentions,  the  design  and  roll  out  of  the  FBI  SRC  plan  may  do 
more  hann  than  good.  The  FBI  may  be  in  a  hurry  to  refer  individuals  to  CVE  programs, 
but  not  having  the  proper  partners  and  relationships  in  place  prior  to  kick  off  is  never 
advisable.  The  result  may  be  distrust  or  an  undermining  of  what  the  CVE  program  could 
do  to  build  relationships,  help  others,  and  protect  the  country. 
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V.  RECOMMENDATIONS  AND  CONCLUSION 


A  number  of  common  and  repeated  themes  are  inherent  in  the  topic  of  this  thesis. 
The  issues  of  risk  and  threats  to  the  community,  community  trust,  delegation  of  roles, 
investigative  restrictions,  and  importance  of  intelligence  remain  as  challenges  that  must 
be  addressed. 

One  of  the  most  important  elements  of  a  successful  CVE  program  will  involve 
assembling  the  right  team  and  establishing  relationships  between  the  stakeholders.  This 
researcher  would  refer  to  the  definition  in  the  newest  SIP  and  re-iterate  that  this  group 
involves  the  public,  LE,  mental  health  practitioners,  government  leaders,  attorneys, 
educators,  NGOs,  and  private  entities.  Each  element  must  not  only  understand  its  own 
role,  but  the  roles  of  others  for  the  effort  to  succeed.  The  importance  of  the  relationship 
with  the  public  was  discussed  previously.  Two  of  the  most  important  groups  that  need  to 
establish  strong  working  relationships  include  the  mental  health  practitioners  and  LE.  The 
theory  of  therapeutic  jurisprudence,  as  proposed  by  Wexler  and  Winick  may  help  to 
explain  the  difference  between  the  two  fields,  and  the  important  relations  between  the 
two.  Frequently,  practitioners  of  each  discipline  do  not  understand  the  role  of  the  other. 
As  a  result,  the  two  fields  tend  to  work  independent  of  each  other  and  view  the  other  with 
suspicion.  The  truth  is  that  both  fields  share  basic  values  and  missions.  To  gain  the  best 
results,  practitioners  from  both  fields  need  to  depend  on  the  expertise  of  the  other  to 
achieve  a  better  result.  Both  disciplines  must  develop  a  true  collaborative  and 
understanding  relationship  for  the  best  results  to  occur.  Fortunately,  this  relationship 
occurs  in  other  areas,  such  as  drug  and  gang  diversion  programs  and  in  CACs. 

For  CVE  intervention  programs  to  operate  successfully,  stakeholders  (using  the 
same  definition  from  the  current  SIP)  must  understand  the  law.  The  three  areas  of  law 
(both  federal  and  state)  that  have  the  greatest  impact  on  CVE  intervention  programs 
include  medical  record  confidentiality  laws,  national  security  laws,  and  duty  to  warn  or 
protect  laws.  An  analysis  of  the  federal  national  security  laws  reveals  that  the  impact  of 
the  Patriot  Act’s  Section  215  represents  a  smaller  change  than  is  expressed  in  literature.  It 

is  critical  that  stakeholders  receive  comprehensive  training  on  these  laws.  As  noted 
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earlier,  many  segments  of  government  and  the  private  sector  frequently  hire  outside 
experts  to  train  their  employees  on  such  topics.  The  training  should  be  provided  to  all 
stakeholders.  It  is  important  that  stakeholders  to  whom  the  laws  may  not  directly  apply, 
such  as  LE,  understand  the  legal  environment  in  which  their  partners  must  work.  It  is  also 
important  that  the  training  be  specific  to  the  state  in  which  the  program  is  operating,  and 
any  neighboring  states  with  which  the  program  may  overlap. 

A.  CVE  INTERVENTION  PROGRAM  ORGANIZATION 

CVE  programs  should  study  and  apply  the  tenets  of  collaborative  models,  such  as 
CIIs  and  MDTs.  CVE  programs,  in  general,  may  benefit  from  a  CII  structure.  For  more 
information  on  the  BRAVE  model,  refer  to  its  strategic  plan.211 

CVE  intervention  programs  should  be  managed  and  run  by  a  MDT  comprised  of 
the  applicable  professionals.  Since  the  goal  of  an  intervention  program  is  provided  by 
mental  health  professionals,  the  MDT  should  be  led  by  an  experienced  mental  health 
practitioner.  The  MDT  would  be  tasked  with  screening  and  assigning  patients  for 
treatment.  The  team  would  then  monitor  progress  and  oversee  the  application  of 
resources  to  the  treatment  plan.  Once  assigned  to  other  professionals  within  the  program, 
the  MDT  would  stand  back  and  monitor  based  on  the  advice  of  the  treating  professional. 

The  MDT  would  also  consist  of  LE  and  legal  experts.  The  goal  of  the  team  would 
be  to  address  any  issues  and  make  suggestions  on  plans  to  address  the  issues.  The 
creation  of  the  team,  similar  to  MDTs  used  for  child  abuse  investigations,  would  facilitate 
a  cooperative  working  environment  on  the  appropriate  practitioners  who  would  bring 
relevant  experience  to  the  effort.  It  is  possible  that  states  hosting  CVE  programs  should 
study  existing  laws  facilitating  infonnation  sharing  among  MDT  members  engaged  in 
responding  to  child  abuse.  In  states  that  have  created  or  altered  laws  to  facilitate  the 
sharing  of  otherwise  protected  infonnation  in  these  situations;  similar  laws  may  be 
needed  for  CVE  intervention  programs. 


21 1  World  Organization  for  Resource  Development  and  Education  (WORDE),  The  Building  Resilience 
against  Violent  Extremism  (BRAVE)  Model — A  Collective  Impact  Initiative  That  Increases  Public  Safety 
and  Social  Cohesion. 
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The  MDT  would  also  monitor  and  respond  to  training  needs  for  members  of  the 
program,  allied  partners,  and  the  public.  The  MDT  would  also  be  responsible  for  the 
application  of  HIPAA  and  state  medical  law  requirements. 

Public  and  private  entities  involved  in  CVE,  and  specifically  intervention,  should 
consider  the  creation  of  a  memorandum  of  understanding  (MOU)  between  involved 
organizations.  A  MOU  would  describe  roles  and  set  rules  prior  to  establishing  a  group 
effort.  The  MOU  would  benefit  by  setting  rules  and  expectations  prior  to  any 
disagreements.  If  a  CVE  program  is  going  to  accept  referrals  from  the  federal 
government,  they  may  consider  including  the  FBI  and  the  U.S.  Attorney’s  Office  in  the 
MOU.  Another  option  would  be  for  the  CVE  itself  to  create  a  contract  with  the  FBI 
(similar  to  a  reverse  SRC  letter)  to  take  the  burden  off  of  the  FBI  and  stimulate  a  more 
fair  perception  of  the  process.  The  contract  between  the  CVE  program  and  the  FBI  would 
still  acknowledge  the  responsibility  the  federal  government  has  to  protect  the  country, 
and  balance  the  need  for  information  with  existing  laws  and  regulations.  The  danger  to 
the  relationship  between  the  federal  government,  local  governments,  and  community  led 
groups  is  the  federal  government’s  tendency  to  use  funding  to  ensure  it  gets  what  it 
wants.  The  federal  government  should  limit  itself  to  coordinating  research  and  providing 
advice,  collating  research,  funding,  referrals,  and  traditional  investigative  efforts.  The 
federal  government  should  also  stay  focused  on  its  correct  assessment  that  local 
governments  are  better  positioned  to  create  community  relationships  and  understand  the 
needs  at  the  local  level.  The  expertise  to  put  the  elements  of  CVE  into  practice  resides  at 
the  local  level. 

B.  MEDICAL  CONFIDENTIALITY 

In  relation  to  medical  confidentiality  laws,  it  is  imperative  that  practitioners 
understand  the  existence  of  both  the  federal  HIPAA  law  and  specific  state  laws.  In 
relation  to  HIPAA,  stakeholders  must  understand  that  the  Privacy  Rule  only  identifies 
two  mandatory  disclosures  of  PHI,  to  the  patient,  and  to  DHHS  for  auditing  purposes. 
The  remaining  exceptions  provide  pennissible  conditions  for  mental  health  practitioners 
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to  share  information.  Relationships  must  be  in  place  prior  to  the  treatment  of  clients  so 
that  stakeholders  understand  the  law  and  know  who  needs  access  to  information. 

CVE  programs  must  also  detennine  if  they  constitute  a  hybrid  entity  and  identify 
the  part  of  the  program  that  must  operate  under  medical  record  laws.  The  program  will 
then  be  responsible  for  segregating  the  portions  of  the  program  so  that  PHI  remains 
secure. 

Programs  involved  in  intervention  and  diversion  efforts  must  then  be  prepared  to 
notify  their  clients  of  the  laws,  and  the  impact  of  the  laws  on  their  treatment  and 
confidential  information.  CVE  programs  will  be  responsible  for  creating  and 
implementing  policies  and  procedures  to  ensure  the  protection  of  PHI  and  training  their 
employees.  These  programs  are  also  responsible  for  designating  employees  to  be 
responsible  and  accountable  for  the  requirements. 

Programs  will  most  likely  advise  clients  of  their  privacy  rights  afforded  by  the 
Privacy  Rule  when  they  are  first  registered.  It  is  an  opportune  time  to  ask  the  client  for 
consent  to  share  their  PHI,  and  explain  under  what  circumstances  this  sharing  may  be 
done.  Consent  is  the  easiest  and  cleanest  practice  that  may  address  the  issue  of 
communication  among  stakeholders.  The  process  must  include  a  written  waiver 
completed  by  the  client.  The  waiver  must  include  the  length  of  the  consent  and  under 
what  circumstances  it  may  be  revoked.  Under  Maryland  law,  the  consent  process  is 
described  under  §4-303.212 

CVE  practitioners  may  also  consider  the  use  of  de-identified  PHI  used  in  a  “safe 
harbor”  method  of  sharing  when  consulting  with  other  stakeholders  as  long  as  the 
information  does  not  identify  the  client.  It  is  a  limited  use  of  PHI,  but  one  that  may  be 
considered  when  other  options  are  not  available. 

Like  the  Privacy  Rule,  Maryland  state  laws  on  medical  record  confidentiality  are 
pennissive  in  nature.  Maryland  law  is  broader  than  the  federal  law  in  regards  to  whom 
PHI  may  be  shared.  Maryland  law  allows  for  the  disclosure  of  PHI  to  any  government 

2 ' 2  State  of  Maryland,  22.  Medical  Records  Act--Duty  to  Hold  Confidential  and  Duty  to  Disclose  a 
Medical  Record,  Health-General  Article  §  §  4-301—4-309,  8-601. 
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agency  conducting  authorized  actions  (as  described  by  law).  Practitioners  will  be 
challenged  when  blending  state  and  federal  law.  Maryland  law  also  allows  for  the  release 
of  information  for  an  investigative  process.  The  law  does  stipulate  that  the  receiving 
agency  must  have  written  policies  in  place  to  protect  the  information.  Many  LE  agencies 
do  not  have  written  procedures  for  the  protection  and  safe  storing  of  PHI.  As  a  result,  LE 
agencies  involved  in  CVE  actions  must  create  these  types  of  policies. 

Practitioners  in  Maryland  must  also  understand  that  they  must  disclose,  or  not 
disclose,  PHI  in  compliance  with  the  law  to  be  immune  from  civil  action. 

C.  DUTY  TO  WARN  AND  PROTECT 

As  with  medical  confidentiality  laws,  training  on  duty  to  warn  and  protect  laws 
will  be  critical  for  mental  health  practitioners  involved  in  CVE  intervention  and 
diversion. 

CVE  intervention  programs  will  be  run  and  performed  by  mental  health 
professionals.  These  experts  should  already  be  well  versed  on  the  ethical  and  legal 
conditions  imposed  upon  their  work.  The  practitioners  may  not,  however,  have 
experience  working  with  other  professionals  from  other  disciplines.  They  also  may  not  be 
well  versed  on  the  exceptions  to  confidentiality  in  relation  to  the  threat  presented  by 
radicalized  persons. 

Since  duty  to  warn  and  duty  to  protect  laws  reside  at  the  state  level,  practitioners 
must  be  aware  of  the  laws  of  the  state  where  they  are  practicing.  Additionally,  many  laws 
are  written  in  a  broad  manner  that  does  not  clearly  articulate  what  is  forbidden,  mandated, 
or  allowed.  Many  of  these  laws,  such  as  Maryland’s,  allow  for  discretion.  Mental  health 
practitioners  must  have  access  to  legal  experts  to  assist  in  deciphering  and  applying  the 
law,  which  is  especially  important  when  situations  are  frequently  not  the  same. 

Mental  health  professionals  have  an  obligation  to  their  clients.  Due  to  the  special 
relationship  between  mental  health  professionals  and  their  clients,  they  may  also  have  a 
legal  obligation  to  protect  third  parties  from  the  actions  of  their  clients.  This  balance  of 
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confidentiality  needed  to  provide  mental  health  treatment  successfully  must  be  balanced 
with  any  threat  to  the  public. 
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